EUVD-2026-99679
GHSA-h8vp-8jwv-9hv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged authenticated access
-
DeliveryInvoke vulnerable Spaceport.sys code path
-
ExploitTrigger use-after-free in kernel
-
ExecutionCorrupt kernel object/memory
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have authenticated, low-privileged local code execution on a Windows host where the Storage Spaces driver (Spaceport.sys) is present and loadable - which is the default on all supported Windows 10, Windows 11, and Windows Server editions listed. No user interaction is needed (UI:N) and complexity is low (AC:L), but exploitation is strictly local (AV:L): there is no remote or network-triggerable path, so the flaw cannot be reached by an unauthenticated or purely remote attacker. The principal limiting factor is this pre-existing local foothold requirement; applying the vendor patch (builds at or above the EUVD-listed fixed versions, e.g. 10.0.26100.9711 for 24H2) removes the condition. |
| Impact | This is a genuine but second-tier priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity privilege-escalation flaw in the Windows Storage Spaces driver (Spaceport.sys) that an already-authenticated low-privileged user can trigger to gain SYSTEM-level control (C:H/I:H/A:H), consistent with CWE-416 use-after-free kernel corruption. The signals are internally consistent but point AWAY from urgency: CISA's SSVC decision shows Exploitation=none and Automatable=no, meaning no observed exploitation and no mass/wormable path, while Technical Impact=total aligns with the full CIA impact. There is no CISA KEV listing and no POC referenced in the data, so this is not confirmed exploited. The main limiter is the local attack vector - an attacker must already have code execution as an authenticated user on the host, so this is a post-compromise escalation primitive rather than an initial-access or remotely wormable bug. EPSS is not provided in the input and cannot be cited. Net: real and patch-worthy (especially on multi-user or shared Windows hosts), but not a drop-everything emergency absent exploitation evidence. |
| Exploit ScenarioDerived | A low-privileged but authenticated user (or malware already running in a limited user context) executes a crafted local program that drives Spaceport.sys into a use-after-free condition, corrupting kernel memory to elevate to SYSTEM. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a reliable exploit, once written, would require no special timing or configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Microsoft Windows Storage Spaces driver (Spaceport.sys) lets an authenticated, low-privileged attacker who already has code execution on a host corrupt kernel memory and obtain SYSTEM-level rights. The defect is a use-after-free (CWE-416) that is locally reachable with low attack complexity and no user interaction, and it affects Windows 10, Windows 11 and Windows Server builds below the fixed versions enumerated in the vendor update. No public exploit code has been identified and CISA's SSVC decision data records no exploitation activity, so this is a genuine but second-tier patching priority relative to any actively exploited issue in the same release cycle.
RemediationAI
Vendor-released patch: Microsoft has published fixed builds in its monthly update for every affected branch - apply the update that brings each host to or above 10.0.17763.9376 (Windows 10 1809 and Server 2019/Server Core), 10.0.19044.7807 (Windows 10 21H2 and 22H2), 10.0.20348.5761 (Server 2022), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2), 10.0.26200.9711 (Windows 11 25H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.26300.9711 (Windows 11 26H2), or 10.0.26100.33650 (Server 2025 and Server Core), per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70102. Because the vector is local (AV:L, PR:L, UI:N) with no remote or network-triggerable path and no public exploit code identified, patch scheduling can be risk-ranked rather than emergency: prioritise multi-session and RDP-accessible hosts, Terminal Server/Citrix-style estates, VDI, and any host where Storage Spaces is actually in use, since privilege escalation here only matters once an attacker already holds authenticated low-privileged code execution. There is no complete configuration workaround that leaves Storage Spaces functional - the vulnerable code lives in a kernel driver that is part of the storage stack - so the realistic compensating controls are restrictive rather than preventive: disable the Storage Spaces feature and the Spaceport.sys driver only on hosts that do not use storage pools (this breaks Storage Spaces pools, virtual disks and any configuration relying on them, and must be validated against boot and storage dependencies before deployment), and tighten local privilege boundaries in the interim by removing unnecessary local admin rights, restricting which accounts can log on interactively or over RDP, and monitoring for unexpected Spaceport.sys or kernel memory-corruption crash telemetry. If a driver-level workaround is applied, treat it as temporary and revert it once the fixed build is installed; Microsoft's advisory should be consulted for any additional mitigations or workaround guidance specific to this CVE.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spaceport.sys is the kernel-mode driver that implements Windows Storage Spaces (the Storage Spaces / storage pool and virtual disk stack), which is present and loaded by default on supported Windows 10, Windows 11 and Windows Server editions. Because the driver runs in kernel mode, a memory-safety defect in its handling of an internal object is a direct kernel compromise primitive: CWE-416 (Use After Free) means a reference to a freed pool allocation is retained and reused, so an attacker who can provoke the free/use ordering can reclaim the freed pool chunk with controlled data and turn the dangling reference into a kernel write or a controlled call target, yielding privilege escalation to SYSTEM within the same kernel security context. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the independent assessment agree that the vector is strictly local - it requires an existing authenticated low-privileged local foothold on a host where Spaceport.sys is loadable - and while the SSVC technical impact is rated total, the automatable flag is 'no' and exploitation is recorded as 'none', so the practical route is manual, post-foothold escalation rather than a wormable or mass-exploitable primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel UAF reachable by an authenticated low-privileged user (AV:L/PR:L), reliably triggerable (AC:L), yielding SYSTEM-level full CIA impact within the same OS scope (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A memory-safety defect in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) affects Windows 10, Windows 11, and Windows Server builds below the versions listed in the vendor update. An attacker who already holds a foothold on a host can use this flaw to escalate to full SYSTEM-level control of that machine, which on servers and multi-user endpoints can translate into access to shared storage, credentials, and downstream systems. No public exploit code has been identified at time of analysis, making this a genuine but second-tier patching priority behind any actively exploited issue in the same release cycle.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB