CVE-2026-71350: Windows Spaceport.sys Buffer Overflow Flaw

CVE-2026-71350 Overview

CVE-2026-71350 is a heap-based buffer overflow [CWE-122] in the Windows Spaceport driver (Spaceport.sys). The flaw allows an unauthorized attacker with physical access to execute code on the target system. Spaceport is the Windows Storage Spaces driver responsible for managing pooled storage volumes.

Microsoft published details through the Microsoft Security Update Guide. The vulnerability requires low attack complexity and no privileges, but exploitation is constrained by the physical attack vector requirement.

Critical Impact
Successful exploitation grants an attacker with physical access the ability to execute arbitrary code within the context of the Spaceport kernel driver, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows (Spaceport.sys driver)
Windows Storage Spaces component
Refer to the Microsoft Security Update Guide for the full list of affected Windows builds

Discovery Timeline

2026-09-08 - CVE-2026-71350 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71350

Vulnerability Analysis

The vulnerability resides in Spaceport.sys, the kernel-mode driver implementing Windows Storage Spaces. The driver mishandles buffer sizing when processing attacker-controlled input from an attached storage device, causing a heap-based buffer overflow in kernel pool memory.

Because Spaceport.sys runs in kernel context, corruption of adjacent pool allocations can be leveraged to overwrite kernel structures and hijack execution flow. The result is arbitrary code execution at the highest privilege level on the affected host.

Exploitation requires the attacker to physically connect a crafted storage device or removable media to the target. This constraint reduces remote exposure but remains relevant for laptops, kiosks, unattended workstations, and environments where devices leave user control.

Root Cause

The root cause is improper validation of a length or offset field associated with data structures parsed by the Spaceport driver. When the driver allocates a heap buffer based on one value but copies data based on another, an out-of-bounds write occurs in the kernel pool. This pattern matches [CWE-122] heap-based buffer overflow. Refer to the Microsoft Security Update Guide for the authoritative technical description.

Attack Vector

An attacker with physical access presents a malicious storage device to the target system. When Windows enumerates the device and invokes Spaceport routines, the crafted metadata triggers the overflow. No user interaction and no prior authentication are required. Public proof-of-concept code is not currently available.

Detection Methods for CVE-2026-71350

Indicators of Compromise

Unexpected loading or crashes of Spaceport.sys recorded in Windows Event Log or WER reports
Bugcheck codes such as KERNEL_MODE_HEAP_CORRUPTION (0x13A) or DRIVER_VERIFIER_DETECTED_VIOLATION correlated with storage device insertion
New or unrecognized removable storage devices attached to endpoints outside of change windows

Detection Strategies

Enable Driver Verifier with Special Pool on Spaceport.sys in test environments to surface heap corruption during triage
Correlate Plug and Play device connection events (Event ID 20001, 20003) with subsequent kernel faults or Spaceport-related errors
Monitor kernel crash dumps for stack frames referencing Spaceport parsing routines

Monitoring Recommendations

Track USB and storage device connection events across managed endpoints, especially on shared or unattended systems
Alert on repeated kernel bugchecks on the same host within short time windows
Review endpoint telemetry for unauthorized storage device classes reaching Storage Spaces workflows

How to Mitigate CVE-2026-71350

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all affected Windows systems
Prioritize patching for laptops, kiosks, and any endpoints located in areas accessible to untrusted personnel
Enforce physical security controls on systems handling sensitive data

Patch Information

Microsoft has released a security update addressing the heap-based buffer overflow in Spaceport.sys. Administrators should deploy the fix through Windows Update, WSUS, or their preferred patch management tooling. Verify installation by confirming the updated Spaceport.sys file version matches the version listed in the Microsoft advisory.

Workarounds

Restrict physical access to endpoints and lock unattended workstations
Disable unused USB and removable storage ports through Group Policy or endpoint configuration where operationally feasible
Apply device control policies to block unauthorized storage device classes from mounting
Enable BitLocker with pre-boot authentication to reduce the utility of physical storage-based attacks

bash

# Example: Block removable storage write access via Group Policy registry key
reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f

# Verify Spaceport.sys file version after patching
powershell -Command "Get-Item C:\Windows\System32\drivers\Spaceport.sys | Select-Object VersionInfo"