Storage Port Driver EUVD-2026-99782

Exploitation requires physical access to the target device (CVSS AV:P) so the attacker can present crafted input to the Windows Storage Port Driver - e.g., physically connecting malicious storage media/hardware or driving local storage I/O to the affected driver. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the absolute dependence on hands-on physical presence is the dominant limiting factor: the attack is not remotely reachable, cannot be automated (SSVC Automatable=no), and does not apply to physically secured or remotely-managed hosts. Affected and unpatched builds are specifically Windows 11 (23H2 <10.0.22631.7652, 24H2/26H1/25H2/26H2 branches) and Windows Server 2025 (<10.0.26100.33650, including Server Core); fully patched builds are not exploitable.

This is a genuinely high-CVSS-but-moderate-real-risk issue for most environments. The CVSS 3.1 base score of 6.8 is held down entirely by the physical attack vector (AV:P), while attack complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N), with total impact to confidentiality, integrity and availability (C:H/I:H/A:H). All three independent exploitation signals point AWAY from urgent mass exploitation: there is no CISA KEV listing, no public POC identified, and the CISA SSVC decision framework explicitly records Exploitation=none and Automatable=no (consistent with a physical vector that cannot be scripted at scale), even though Technical Impact=total aligns with the full CIA impact. These signals are mutually consistent rather than conflicting - a high technical impact paired with a non-automatable physical precondition. The practical takeaway: this is a 'targeted/insider or evil-maid' class privilege-escalation flaw, not an internet-facing worm candidate. Note one labeling nuance: the description frames this as an 'unauthorized attacker' elevating privileges, which matches PR:N, but elevation-of-privilege semantics in Microsoft advisories typically presume the attacker already has physical/local presence; EPSS is not provided in the input, so probabilistic exploitation likelihood could not be independently weighed.

An attacker with physical access to an unattended or stolen device (e.g., an 'evil maid' scenario against a laptop) attaches crafted storage hardware or sends a malformed request to the Windows Storage Port Driver to trigger a heap-based buffer overflow in kernel-mode code. Successful exploitation corrupts kernel heap memory to execute code at elevated privilege, yielding full control (C:H/I:H/A:H) of the system. No public exploit code has been identified at time of analysis, and low attack complexity (AC:L) means no special timing or memory-grooming races are required once physical access is obtained.