CVE-2026-72942: Windows Spaceport.sys Information Disclosure

CVE-2026-72942 Overview

CVE-2026-72942 is an out-of-bounds read vulnerability [CWE-125] in the Windows Spaceport driver (Spaceport.sys). The flaw allows an unauthorized network-based attacker to disclose information from the affected system. Exploitation requires user interaction, which limits automated large-scale abuse but keeps phishing-style delivery viable.

The Spaceport driver supports Storage Spaces, a Windows feature for pooling and virtualizing disks. A read beyond an allocated buffer in this driver can leak kernel or process memory contents across a network attack path.

Critical Impact
An unauthenticated attacker can trigger Spaceport.sys to read memory outside allocated bounds, disclosing sensitive information over the network when a user interacts with malicious content.

Affected Products

Microsoft Windows (Spaceport driver Spaceport.sys)
Windows systems using Storage Spaces functionality
Refer to the Microsoft Security Update CVE-2026-72942 advisory for the complete list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72942 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72942

Vulnerability Analysis

The vulnerability resides in Spaceport.sys, the kernel-mode driver that implements Microsoft Storage Spaces. An out-of-bounds read occurs when the driver processes attacker-influenced input without validating a length or index against the underlying buffer size. The read returns memory that was never intended to be exposed to the caller.

Because the flaw is reachable over a network attack vector, an attacker can craft content that triggers the vulnerable code path when a user opens or interacts with it. The disclosed bytes may include pointers, credentials, or other memory contents useful for chaining further attacks such as bypassing address space layout randomization.

Root Cause

The root cause is missing or insufficient bounds checking in Spaceport.sys when parsing structured input. The driver reads past the end of an allocated buffer, returning residual kernel or process memory to the caller. This class of issue is tracked as [CWE-125] Out-of-bounds Read.

Attack Vector

Exploitation is remote but requires user interaction. An attacker delivers crafted content, such as a malicious file or link, that causes the target system to invoke the vulnerable Spaceport code path. Successful exploitation results in confidentiality impact only; integrity and availability are not affected.

No public proof-of-concept exploit is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2026-72942 advisory for exploitation prerequisites.

Detection Methods for CVE-2026-72942

Indicators of Compromise

Unexpected loads or crashes involving Spaceport.sys in Windows Event Logs and WER reports
Anomalous access to Storage Spaces virtual disks originating from remote or user-opened content
Kernel memory dump artifacts referencing Spaceport driver stack frames near read faults

Detection Strategies

Hunt for user-opened files that immediately precede Spaceport driver faults or unusual memory reads
Correlate email or web-delivered attachments with subsequent kernel-mode driver activity on the endpoint
Monitor for outbound network transfers that follow interaction with untrusted files targeting Storage Spaces APIs

Monitoring Recommendations

Enable Windows kernel and driver telemetry to capture faults and unusual reads in Spaceport.sys
Forward endpoint telemetry to a centralized data lake for retention and cross-host correlation
Track patch compliance status for the Microsoft update addressing CVE-2026-72942 across the fleet

How to Mitigate CVE-2026-72942

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-72942 to all affected Windows systems
Prioritize patching on systems that handle untrusted user content such as email gateways and user workstations
Reinforce user awareness on opening unsolicited files or links that could trigger the vulnerable code path

Patch Information

Microsoft has issued a security update through the Microsoft Security Response Center. Consult the Microsoft Security Update CVE-2026-72942 advisory for the specific KB numbers and build versions that remediate this vulnerability. Deploy the update through Windows Update, WSUS, or your standard patch management pipeline.

Workarounds

No official vendor workaround is documented; patching is the primary remediation
Restrict delivery of high-risk file types through email and web filtering until patches are applied
Reduce exposure by disabling or limiting Storage Spaces features on systems where the functionality is not required, where operationally feasible

bash

# Verify installed updates on Windows and confirm patch presence
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20