CVE-2026-35415: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-35415 Overview

CVE-2026-35415 is an integer overflow vulnerability in the Windows Storage Spaces Controller. An authorized local attacker can trigger the flaw to elevate privileges on affected Windows client and server systems. Microsoft confirmed the issue affects a broad range of supported releases, from Windows 10 1607 through Windows 11 26H1 and from Windows Server 2012 R2 through Windows Server 2025. The weakness maps to [CWE-190] (Integer Overflow or Wraparound) and carries an EPSS probability of 0.06% (percentile 18.8) as of 2026-05-17. No public exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation grants high impact to confidentiality, integrity, and availability, enabling a low-privileged local user to gain elevated privileges on the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and arm64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and arm64
Microsoft Windows Server 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-05-12 - CVE-2026-35415 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-35415

Vulnerability Analysis

The Windows Storage Spaces Controller manages virtualization of physical disks into pools and virtual disks. The controller exposes I/O control interfaces accessible to local users for status queries and configuration of storage resources. CVE-2026-35415 stems from arithmetic performed on attacker-influenced size or count values that wrap around the bounds of their integer type. The wrap produces an undersized allocation or a miscalculated buffer length used in subsequent kernel memory operations.

Because the controller runs with elevated privileges in the Windows kernel context, downstream memory writes operate in a security boundary far above the calling user. A local attacker who already holds a standard user account on the system can craft requests that exercise the vulnerable code path and corrupt kernel objects, ultimately executing code or modifying data at SYSTEM privilege. The vulnerability requires local access and low privileges, with no user interaction.

Root Cause

The root cause is an integer overflow or wraparound [CWE-190] in size or length arithmetic within the Storage Spaces Controller. When attacker-supplied values are multiplied or added without checked arithmetic, the result wraps to a small value. The wrapped value is then trusted by allocation and copy logic, producing a heap mismatch the attacker can leverage to corrupt adjacent memory.

Attack Vector

The attack vector is local. An authenticated user invokes the Storage Spaces Controller through documented IOCTL or device interfaces with crafted parameters that trigger the overflow. No remote network path and no user interaction is required. Refer to the Microsoft Security Update Guide for CVE-2026-35415 for vendor technical details.

No verified public proof-of-concept exists at the time of writing. Technical exploitation details are described in prose only to avoid speculation.

Detection Methods for CVE-2026-35415

Indicators of Compromise

Unexpected creation of processes running as NT AUTHORITY\SYSTEM parented to standard user sessions on hosts where Storage Spaces is enabled.
Kernel bug check events or spaceport.sys and spacecontrol.sys driver crashes coinciding with user-mode activity from non-administrative accounts.
Anomalous use of Storage Spaces management APIs or PowerShell cmdlets such as Get-StoragePool and New-VirtualDisk from non-administrative contexts.

Detection Strategies

Monitor Windows Event Log channels Microsoft-Windows-StorageSpaces-Driver/Operational and System for driver faults, unexpected restarts of the Storage Spaces service, or repeated handle-open failures.
Hunt for token elevation events (Event ID 4672) granted to processes spawned by accounts that should not hold administrative rights.
Correlate process creation telemetry (Event ID 4688 or Sysmon Event ID 1) with subsequent privileged operations from the same parent process.

Monitoring Recommendations

Baseline normal access patterns to the Storage Spaces Controller and alert on standard user accounts opening handles to its device objects.
Forward EDR and Windows Security telemetry into a centralized SIEM or data lake for cross-host correlation of local privilege escalation patterns.
Track patch state of all affected Windows builds and flag hosts that remain unpatched after the Microsoft security release.

How to Mitigate CVE-2026-35415

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-35415 to all affected Windows 10, Windows 11, and Windows Server hosts.
Inventory systems where the Storage Spaces feature is in use and prioritize those for patching, especially multi-user servers and shared workstations.
Restrict interactive and remote desktop access on unpatched hosts to trusted administrators until updates are deployed.

Patch Information

Microsoft released a security update addressing CVE-2026-35415. The fix is distributed through the standard monthly cumulative update channel for each affected Windows release. Administrators should consult the Microsoft Security Update Guide for the specific knowledge base article and build numbers that apply to each operating system version.

Workarounds

No vendor-supplied workaround replaces the security update; patching is the required remediation.
Where patching must be delayed, limit local logon rights and remove standard users from systems that expose the Storage Spaces Controller.
Enforce application allow-listing to block unknown binaries that could be used to deliver exploit payloads to local users.

bash

# Verify installed updates and Storage Spaces driver versions on Windows hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-WindowsDriver -Online | Where-Object { $_.OriginalFileName -like "*spaceport*" -or $_.OriginalFileName -like "*spacecontrol*" }
Get-StoragePool | Select-Object FriendlyName, OperationalStatus, HealthStatus