CVE-2026-70569: Windows Spaceport.sys Privilege Escalation

CVE-2026-70569 Overview

CVE-2026-70569 is an out-of-bounds read vulnerability in the Windows Spaceport driver (Spaceport.sys). The flaw allows an authorized local attacker to elevate privileges on an affected Windows system. Spaceport is the Windows Storage Spaces driver responsible for managing virtualized storage pools. Successful exploitation requires local access and low-level privileges but no user interaction.

Critical Impact
A local attacker with standard user privileges can read out-of-bounds kernel memory in Spaceport.sys and escalate to higher privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows (Spaceport.sys kernel driver)
Windows Storage Spaces component
Refer to the Microsoft Security Update Guide for the full list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-70569 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-70569

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in Spaceport.sys, the kernel-mode driver that implements Windows Storage Spaces. When the driver processes attacker-influenced input, it reads memory beyond the intended buffer boundary. Because the driver runs in kernel mode, an out-of-bounds read exposes kernel memory contents that a low-privileged user process should not be able to access.

Attackers commonly chain this class of kernel information disclosure with other primitives to defeat kernel address space layout randomization (KASLR) and stage a full local privilege escalation. The vulnerability impacts confidentiality, integrity, and availability, indicating the read primitive can be leveraged beyond simple information disclosure.

The attack vector is local, and the attacker must already be authenticated on the target host. No user interaction is required, and the exploit executes in the context of the current session. The current EPSS probability is 0.318%, reflecting no observed in-the-wild exploitation at time of publication.

Root Cause

The root cause is missing or insufficient bounds checking on data structures processed by Spaceport.sys. The driver dereferences a pointer or reads past the end of a buffer, returning adjacent kernel memory to the caller. Microsoft has not published the specific code path affected.

Attack Vector

Exploitation requires a local, authenticated user. The attacker issues crafted I/O control requests (IOCTLs) or triggers a code path in the Storage Spaces subsystem that reaches the vulnerable read. Detailed technical analysis is available through the Microsoft Security Update Guide. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2026-70569

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-70569.
Monitor for unexpected user-mode processes opening handles to Storage Spaces device objects associated with Spaceport.sys.
Watch for unexplained process privilege changes following interactions with the Storage Spaces subsystem.

Detection Strategies

Enable kernel-mode driver telemetry and alert on unusual IOCTL patterns targeting Spaceport.sys.
Correlate local logon events with subsequent token elevation or new SYSTEM-context processes spawned by non-administrative users.
Deploy EDR rules that flag low-integrity processes performing repeated DeviceIoControl calls against storage driver device objects.

Monitoring Recommendations

Collect Windows Security event IDs 4672 and 4688 to identify unexpected privilege assignments and process creation.
Ingest Sysmon Event ID 6 (driver loaded) and Event ID 1 (process create) into your SIEM for behavioral baselining.
Track patch deployment status for Spaceport.sys across the fleet to identify unpatched hosts.

How to Mitigate CVE-2026-70569

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-70569 to all affected Windows systems as soon as testing permits.
Prioritize patching multi-user systems, terminal servers, and hosts accessible to lower-trust users.
Audit local user accounts and remove unnecessary interactive logon rights to reduce the attack surface.

Patch Information

Microsoft has issued a security update addressing CVE-2026-70569. Consult the Microsoft Security Update Guide for build-specific patch identifiers and installation instructions. Deploy the update through Windows Update, WSUS, Microsoft Intune, or your standard patch management platform.

Workarounds

No official workaround has been published by Microsoft; patching is the required remediation.
Enforce the principle of least privilege to limit which users can log on interactively to affected hosts.
Restrict access to systems that rely on Storage Spaces until the patch is applied and verified.

bash

# Verify installed KB updates addressing CVE-2026-70569
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Confirm the Spaceport driver version on the host
Get-Item C:\Windows\System32\drivers\Spaceport.sys | Select-Object VersionInfo