CVE-2026-71345 Overview
CVE-2026-71345 is an out-of-bounds write vulnerability [CWE-787] in the Windows Spaceport driver (Spaceport.sys). The flaw allows an authorized local attacker to execute arbitrary code on the affected host. Spaceport is the Microsoft driver that underpins Storage Spaces functionality on Windows.
An attacker who already has local access and low-level privileges can trigger memory corruption inside kernel space. Successful exploitation leads to elevation of privilege and full compromise of confidentiality, integrity, and availability.
Critical Impact
Local attackers with standard user privileges can execute code in kernel context by triggering the out-of-bounds write in Spaceport.sys, resulting in SYSTEM-level compromise.
Affected Products
- Microsoft Windows (Storage Spaces / Spaceport.sys driver)
- Windows client editions shipping the Spaceport driver
- Windows Server editions shipping the Spaceport driver
Discovery Timeline
- 2026-09-08 - CVE-2026-71345 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-71345
Vulnerability Analysis
The vulnerability resides in Spaceport.sys, the kernel-mode driver that implements Microsoft Storage Spaces. An out-of-bounds write [CWE-787] occurs when the driver writes data past the end of an allocated buffer inside kernel memory. Because the write happens in kernel context, corruption of adjacent structures can be steered toward code execution.
The attack requires local access and low privileges, with no user interaction. Exploitation yields high impact to confidentiality, integrity, and availability. The Exploit Prediction Scoring System (EPSS) currently places exploitation probability at 0.318%.
No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is insufficient bounds checking on data written by Spaceport.sys into a kernel buffer. When the driver processes attacker-controlled input through an I/O control code (IOCTL) or device interface, it fails to validate the destination size before performing a write. This mismatch allows the attacker to overwrite adjacent kernel objects.
Attack Vector
An authenticated local attacker opens a handle to the Spaceport device and issues a crafted request. The driver processes the request and performs a write beyond the intended buffer boundary. Attackers typically corrupt adjacent kernel structures — such as pool headers or object pointers — to hijack execution flow and gain SYSTEM privileges.
No network path exists for this vulnerability. Remote exploitation requires chaining with a separate initial-access primitive.
No public exploit code is available. See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2026-71345
Indicators of Compromise
- Unexpected loading or unusual handle opens against the Spaceport device object from non-administrative processes.
- Kernel bugchecks referencing Spaceport.sys in crash dumps, particularly SYSTEM_SERVICE_EXCEPTION or pool corruption stops.
- New or unexpected SYSTEM-level processes spawned by low-privilege user sessions immediately after Spaceport driver interaction.
Detection Strategies
- Monitor for user-mode processes calling DeviceIoControl against Spaceport device handles with anomalous input buffer sizes.
- Detect kernel crashes that name Spaceport.sys in the faulting module field of Windows Error Reporting telemetry.
- Correlate token elevation events (Event ID 4672) with recent driver-interaction activity from standard user accounts.
Monitoring Recommendations
- Ingest Windows kernel crash telemetry and Sysmon Event ID 6 (driver loaded) into a central analytics pipeline.
- Baseline normal Storage Spaces usage in the environment to identify anomalous IOCTL patterns.
- Track process lineage where standard user processes precede unexplained SYSTEM process creation.
How to Mitigate CVE-2026-71345
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing permits.
- Prioritize patching on multi-user systems, jump hosts, and Remote Desktop servers where local attackers are most likely.
- Audit local account privileges and remove unnecessary interactive logon rights.
Patch Information
Microsoft has published a fix through the Microsoft Security Update Guide. Consult the vendor advisory for the specific KB article and build numbers that correspond to each supported Windows release. Deploy updates through Windows Update, Windows Server Update Services (WSUS), or your standard patch management tooling.
Workarounds
- No official workaround is documented; patching is the recommended remediation path.
- Restrict local logon and remote interactive access to trusted administrators until updates are deployed.
- Enforce application allowlisting to limit which processes can interact with kernel device objects.
# Verify the installed version of Spaceport.sys on a Windows host
Get-Item C:\Windows\System32\drivers\Spaceport.sys | Select-Object VersionInfo
# List pending Windows updates via PowerShell
Get-WindowsUpdate -MicrosoftUpdate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.