CVE-2026-71349: Windows Spaceport.sys Buffer Overflow Flaw

CVE-2026-71349 Overview

CVE-2026-71349 is a heap-based buffer overflow [CWE-122] in the Windows Spaceport driver (Spaceport.sys). An unauthorized attacker with physical access to a target system can trigger the overflow to execute code within the kernel driver context. The Spaceport driver supports Storage Spaces functionality in Windows, and memory corruption in this component can compromise confidentiality, integrity, and availability of the affected host.

Microsoft published the advisory on 2026-09-08 and last updated the entry on 2026-09-09. The vulnerability requires no privileges and no user interaction, but exploitation is constrained by the physical attack vector requirement.

Critical Impact
Successful exploitation via physical access yields code execution against Spaceport.sys, resulting in full compromise of the affected Windows endpoint.

Affected Products

Microsoft Windows (versions using the Spaceport.sys driver)
Windows Storage Spaces subsystem
Refer to the Microsoft Security Update Guide for the authoritative product and build list

Discovery Timeline

2026-09-08 - CVE-2026-71349 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71349

Vulnerability Analysis

The flaw resides in Spaceport.sys, the kernel-mode driver that implements Storage Spaces virtualization in Windows. A heap-based buffer overflow occurs when the driver writes attacker-influenced data beyond the bounds of a pool allocation on the kernel heap. Because the code path runs in kernel context, corruption of adjacent pool metadata or object pointers can be steered into arbitrary code execution.

Exploitation requires physical access to the machine. This typically involves attaching a crafted storage device, external bus interface, or removable media that the Spaceport driver enumerates or parses. Once triggered, the attacker gains code execution capable of compromising confidentiality, integrity, and availability.

Root Cause

The root cause is insufficient validation of size or length fields prior to a copy operation into a heap-allocated buffer inside Spaceport.sys. When a malformed structure is supplied, the driver writes beyond the allocation boundary, corrupting adjacent kernel pool memory. Microsoft has not published the specific field or function at fault.

Attack Vector

The attack vector is physical (AV:P). An attacker must interact with the target hardware directly, most plausibly by presenting a malicious storage device or bus-attached component that the Spaceport driver processes during device enumeration or I/O. No authentication or user interaction is required once physical access is achieved.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.418%.

Detection Methods for CVE-2026-71349

Indicators of Compromise

Unexpected bugchecks (BSODs) referencing Spaceport.sys in crash dumps or Minidump files
Kernel pool corruption events surfaced by Driver Verifier or Special Pool during Storage Spaces operations
Insertion of unknown USB, Thunderbolt, or externally attached storage devices immediately preceding a system crash or reboot

Detection Strategies

Enable Driver Verifier with Special Pool and pool tracking on Spaceport.sys in high-risk environments to catch out-of-bounds writes at the point of corruption
Correlate Windows Event Log entries for driver load, storage device arrival (Microsoft-Windows-Kernel-PnP), and abnormal shutdowns
Ingest kernel crash telemetry into a centralized analytics platform and alert on repeated faults referencing the Spaceport module

Monitoring Recommendations

Monitor for physical device attach events (Event ID 6416 in the Security log) on servers and workstations that should not accept removable media
Track boot-time driver integrity and hash of Spaceport.sys against the vendor-patched version
Alert on any endpoint reporting kernel pool corruption bugchecks (0x19, 0xC2, 0x139) that reference storage drivers

How to Mitigate CVE-2026-71349

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all affected Windows systems
Restrict physical access to servers, workstations, and kiosks, particularly systems exposed in public or shared spaces
Disable unused external bus interfaces (USB, Thunderbolt, eSATA) via firmware or Group Policy on high-value endpoints

Patch Information

Microsoft has issued a security update addressing the heap-based buffer overflow in Spaceport.sys. Consult the Microsoft Security Update Guide for the specific KB articles, affected Windows builds, and applicable cumulative updates. Prioritize deployment on endpoints where physical access controls are weaker.

Workarounds

Enforce port control and removable-media policies through Group Policy or endpoint device control to block unauthorized storage devices
Enable BitLocker with pre-boot authentication to raise the barrier for attackers with brief physical access
Where Storage Spaces is not required, evaluate disabling or restricting driver load with a supported configuration change from Microsoft

bash

# Example: Block installation of removable storage devices via Group Policy
# Computer Configuration > Administrative Templates > System >
#   Removable Storage Access > All Removable Storage classes: Deny all access = Enabled
#
# Or via PowerShell to disable the Removable Storage service on hardened hosts:
Set-Service -Name "USBSTOR" -StartupType Disabled