Windows Storage Spaces EUVD-2026-99660

Exploitation requires the attacker to already have an authenticated local session on the affected host AND to hold HIGH privileges (CVSS PR:H), then execute code locally that feeds malformed input to the Windows Storage Spaces Controller component to trigger the heap overflow. There is no remote vector (AV:L) and no user interaction is needed (UI:N), but the PR:H prerequisite means this is strictly a post-compromise escalation step - it cannot be used for initial access and is not exploitable against an unauthenticated or low-privileged attacker. Affected deployments are those running vulnerable builds below the patched versions across Windows 10/11 and Windows Server 2016-2025; patching to the fixed build fully removes the condition.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7 Medium) describes local privilege escalation requiring the attacker to already hold HIGH privileges (PR:H), which substantially limits reach and explains why the score stays in the Medium band despite total C/I/A impact. The signals are internally consistent and mutually reinforcing: CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', aligning with the local attack vector and the absence of any KEV listing or public POC - there is no public exploit identified at time of analysis. The one tension worth noting is that SSVC Technical Impact is 'total' (matching C:H/I:H/A:H), yet the CVSS score is only Medium; this divergence is expected because CVSS weights the PR:H precondition heavily while SSVC's Technical Impact ignores exploitability prerequisites. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: a credible local EoP chainable from an already-compromised account, patch-worthy on a normal cadence, but not an active-exploitation fire drill.

An attacker who has already gained an authenticated foothold on a Windows host (for example via phishing or a separate initial-access bug) runs a crafted local program that supplies malformed input to the Storage Spaces Controller, triggering a heap-based buffer overflow. Successful exploitation corrupts kernel-adjacent heap structures to execute code at SYSTEM, elevating from the attacker's existing privileges to full host compromise. No public exploit code has been identified, and the attack requires local access plus pre-existing privileges, so it functions as a post-compromise escalation step rather than an entry point.