CVE-2026-72937 Overview
CVE-2026-72937 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Storage Port Driver. An authorized local attacker can exploit the flaw to read memory outside allocated buffer boundaries and disclose sensitive kernel information. The vulnerability requires local access and low-privilege authentication, but no user interaction. Successful exploitation impacts confidentiality without affecting integrity or availability. Microsoft published guidance for this issue through the Microsoft Security Response Center (MSRC).
Critical Impact
A locally authenticated attacker can leak kernel memory contents from the Storage Port Driver, potentially exposing data useful for further privilege escalation attacks.
Affected Products
- Microsoft Windows Storage Port Driver (see Microsoft CVE-2026-72937 Update Guide for affected builds)
Discovery Timeline
- 2026-09-08 - CVE CVE-2026-72937 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-72937
Vulnerability Analysis
The Storage Port Driver (storport.sys) mediates communication between the Windows storage stack and miniport drivers for SCSI, SAS, and other block storage controllers. The driver processes I/O request packets (IRPs) and control codes originating from user mode through documented device interfaces. An out-of-bounds read [CWE-125] occurs when the driver reads beyond the bounds of an allocated buffer while handling attacker-controlled input.
Because the driver runs in kernel context, disclosed bytes may include pool metadata, pointers useful for defeating Kernel Address Space Layout Randomization (KASLR), or fragments of adjacent I/O buffers. The exposure is limited to confidentiality; the flaw does not permit writes, code execution, or denial of service on its own.
Root Cause
The root cause is missing or incorrect bounds validation on a length or offset field consumed by the Storage Port Driver before it reads from a buffer. When the supplied value exceeds the allocated size, the driver returns memory contents past the end of the intended structure. Microsoft has not published detailed root-cause analysis; consult the Microsoft CVE-2026-72937 Update Guide for authoritative technical details.
Attack Vector
Exploitation requires local access with valid credentials on the target host. An attacker with a standard user account issues a crafted device I/O control request to a storage device object exposed by storport.sys. The driver processes the malformed request and returns data from adjacent kernel memory to the calling process. No user interaction is required, and the attack complexity is low.
No public proof-of-concept exploit code is available at the time of publication.
Detection Methods for CVE-2026-72937
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-72937.
- Unexpected user-mode processes issuing repeated DeviceIoControl requests to storage device objects such as \\.\PhysicalDrive* or \\.\Scsi* should be treated as suspicious.
Detection Strategies
- Monitor endpoint telemetry for standard-privilege processes that open handles to raw storage device objects and issue non-standard IOCTL codes.
- Correlate storage device handle acquisition with subsequent memory-region reads that are inconsistent with normal application behavior.
- Baseline legitimate applications that interact with storport.sys (backup agents, disk utilities) and alert on deviations from the baseline.
Monitoring Recommendations
- Enable Windows kernel auditing for driver access events and forward them to a centralized analytics platform.
- Track Microsoft patch deployment status across the estate to identify unpatched hosts exposed to local information disclosure.
- Review process creation events for reconnaissance tools that enumerate storage devices prior to attempting kernel memory disclosure.
How to Mitigate CVE-2026-72937
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-72937 Update Guide as soon as it is available for your Windows build.
- Restrict interactive and remote logon rights on sensitive systems to reduce the population of accounts able to trigger the flaw locally.
- Audit local accounts and remove unused low-privilege accounts that could be leveraged for local exploitation.
Patch Information
Microsoft addresses this vulnerability through its regular security update channel. Refer to the Microsoft CVE-2026-72937 Update Guide for the specific KB article numbers, affected Windows versions, and update packages applicable to your environment. Deploy updates through Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management platform.
Workarounds
- No vendor-supplied workarounds have been documented. Patching is the only supported remediation.
- Apply the principle of least privilege and limit local logon rights to trusted administrators where operationally feasible.
- Enforce application allow-listing to block unauthorized binaries from interacting with kernel driver interfaces.
# Verify installed updates on a Windows host (run in elevated PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Confirm the Storage Port Driver version after patching
Get-Item C:\Windows\System32\drivers\storport.sys | Select-Object VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
