CVE-2026-69535: Windows Spaceport.sys Privilege Escalation

CVE-2026-69535 Overview

CVE-2026-69535 is a numeric truncation error in the Windows Spaceport driver (Spaceport.sys) that enables local privilege escalation. An authorized attacker with low privileges can exploit the flaw to gain elevated permissions on an affected system. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow), indicating memory corruption caused by improper handling of integer values. Microsoft published the advisory on September 8, 2026.

Critical Impact
Successful exploitation allows a local, low-privileged user to elevate to SYSTEM, resulting in full compromise of confidentiality, integrity, and availability on the target host.

Affected Products

Microsoft Windows (Spaceport.sys driver component)
Refer to the Microsoft Vulnerability Advisory CVE-2026-69535 for the complete list of affected builds
Storage Spaces functionality provided by Spaceport.sys

Discovery Timeline

2026-09-08 - CVE-2026-69535 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69535

Vulnerability Analysis

The defect resides in Spaceport.sys, the kernel-mode driver that implements Windows Storage Spaces. A numeric truncation error occurs when the driver converts a larger integer type into a smaller one without validating that the value fits. This truncation produces an undersized allocation or length calculation that is later used to copy attacker-controlled data. The result is a heap-based buffer overflow in kernel pool memory, classified as [CWE-122].

Because the flaw executes inside a kernel driver, memory corruption can be steered into arbitrary write primitives. Attackers use those primitives to overwrite kernel objects and pivot to SYSTEM-level execution. Exploitation requires local access and valid credentials, but no user interaction is needed once the attacker has a foothold.

Root Cause

The root cause is unsafe narrowing conversion inside Spaceport.sys. A size or count field derived from user-controlled input is stored in a smaller integer type, discarding upper bits. Subsequent allocation and copy routines trust the truncated value, producing an inconsistent buffer boundary in the kernel pool.

Attack Vector

An attacker with local, authorized access issues crafted I/O control requests to the Spaceport device interface. The request carries values that trigger truncation during size computation. The driver then writes past the allocated boundary, corrupting adjacent kernel structures. Exploitation completes when the attacker converts the corruption into arbitrary kernel read/write and replaces a process token with a SYSTEM token.

No public proof-of-concept is available at this time. See the Microsoft Vulnerability Advisory CVE-2026-69535 for vendor-provided technical detail.

Detection Methods for CVE-2026-69535

Indicators of Compromise

Unexpected loading or interaction with Spaceport.sys from non-administrative user sessions.
Kernel bugchecks (BSOD) referencing Spaceport.sys or pool corruption codes such as 0x19 (BAD_POOL_HEADER) or 0xC2 (BAD_POOL_CALLER).
Sudden token changes where a non-privileged process begins executing with SYSTEM privileges.
Creation of new services, scheduled tasks, or local administrator accounts immediately following anomalous kernel events.

Detection Strategies

Monitor process integrity level transitions from Medium/Low to System without a legitimate parent process chain.
Correlate crash dump telemetry from endpoints for repeated faults in Spaceport.sys, which often precede successful exploitation attempts.
Alert on non-standard processes opening handles to Storage Spaces device objects such as \\.\SpaceportControl.

Monitoring Recommendations

Ingest Windows kernel event logs and WER (Windows Error Reporting) crash artifacts into a centralized analytics platform.
Enable Sysmon Event ID 6 (driver loaded) and Event ID 10 (process access) with tight filters around SYSTEM token duplication.
Track post-exploitation behaviors such as lsass.exe credential access, service creation, and privileged group modifications following any Spaceport-related fault.

How to Mitigate CVE-2026-69535

Immediate Actions Required

Apply the security update referenced in the Microsoft Vulnerability Advisory CVE-2026-69535 to all affected Windows systems.
Prioritize patching multi-user systems, jump hosts, and virtualization hosts where local accounts exist.
Audit local account inventories and remove unnecessary interactive logon rights to reduce the attacker population.

Patch Information

Microsoft has released a security update addressing the numeric truncation in Spaceport.sys. Administrators should consult the Microsoft Vulnerability Advisory CVE-2026-69535 for the KB number, affected build ranges, and update packages that correspond to each supported Windows release.

Workarounds

No official workaround has been published by Microsoft; patching is the required remediation path.
Where patching must be delayed, restrict local logon rights and enforce application allowlisting to limit which binaries can invoke driver interfaces.
Enable attack surface reduction rules and Credential Guard to raise the cost of post-exploitation token theft.

bash

# Verify installed updates on a Windows host and confirm the patch KB is present
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20