Windows Storage Spaces EUVD-2026-99639

Exploitation requires the attacker to already have authenticated low-privileged code execution on the local Windows host (PR:L, AV:L) - this is a post-compromise elevation primitive, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once a local foothold exists the overflow can be triggered reliably against the Storage Spaces Controller in a default configuration; no special feature toggle or non-default setting is named in the description. The primary limiting factors are therefore the need for prior local access and valid (even if unprivileged) credentials; it cannot be exploited over the network or by an unauthenticated actor. Affected builds span Windows 10/11 client and Windows Server 2012 through 2025 per EUVD, so patch level (not configuration) is the main gating factor.

This is a credible, patch-worthy local privilege-escalation issue but not a top-of-queue emergency on raw-signal grounds. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent: an already-authenticated local user (PR:L) with low attack complexity and no user interaction corrupts a heap buffer in the Storage Spaces Controller to gain full C/I/A impact - i.e., SYSTEM-level elevation. The local attack vector means this is not internet-reachable and cannot be used for initial access; it is a second-stage tool for an attacker who already has a foothold. No EPSS score, CISA KEV entry, or POC indicator was supplied in the input, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV data is a gap, not a negative signal - it simply cannot be weighed. A vendor patch is available, which is the strongest actionable signal here. Net: a real priority for patch management because of the ubiquity of the affected Windows platform and the clean, low-complexity EoP primitive, but it is not an actively-exploited crisis based on the data provided. No conflicting signals were detected between the CVSS vector and the description - both agree on local, authenticated elevation.

An attacker who already has a low-privileged foothold on a Windows host (for example via phishing, stolen credentials, or a separate RCE) runs a crafted local program that sends malformed input to the Storage Spaces Controller, triggering a heap-based buffer overflow and executing attacker-controlled code as SYSTEM. This converts limited local access into full control of the machine. No public exploit was identified in the provided data, so any current exploitation would require attacker-developed code.