CVE-2026-72946: Storage Port Driver Privilege Escalation

CVE-2026-72946 Overview

CVE-2026-72946 is a heap-based buffer overflow [CWE-122] in the Windows Storage Port Driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected host. Microsoft documented the issue in the Microsoft Security Response Center (MSRC) advisory. The vulnerability requires local access and low privileges, and it does not require user interaction. Successful exploitation impacts confidentiality, integrity, and availability at the kernel level.

Critical Impact
Successful exploitation grants SYSTEM-level privileges on Windows hosts running the vulnerable Storage Port Driver, enabling full compromise of the operating system.

Affected Products

Microsoft Windows (Storage Port Driver component)
Refer to the Microsoft Security Update Guide for the full list of affected builds
Server and client editions shipping the affected driver

Discovery Timeline

2026-09-08 - CVE-2026-72946 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72946

Vulnerability Analysis

The flaw resides in the Windows Storage Port Driver, a kernel-mode component that mediates I/O requests between the storage stack and underlying miniport drivers. A heap-based buffer overflow occurs when the driver writes beyond the bounds of a dynamically allocated pool buffer. Because the driver executes in kernel context, corruption of adjacent pool memory can be steered into arbitrary kernel writes. An authorized local user can trigger the overflow by issuing crafted I/O control requests to the driver. The result is escalation from a standard user context to SYSTEM.

Root Cause

The root cause is improper validation of a length or size field used during a heap allocation or copy operation inside the Storage Port Driver. The driver allocates a pool buffer using one size value and copies attacker-influenced data using a larger size, producing an out-of-bounds write on the kernel heap. Microsoft has not published detailed root-cause documentation beyond the MSRC advisory.

Attack Vector

Exploitation requires local access with a valid account on the target host. The attacker sends malformed I/O control code (IOCTL) requests to the vulnerable driver interface. No user interaction is required, and the attack complexity is low. This class of driver flaw is commonly abused as a second stage after initial access, for example following phishing or credential theft, to reach SYSTEM and disable endpoint controls.

No public proof-of-concept code is available for CVE-2026-72946 at the time of writing. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-72946

Indicators of Compromise

Unexpected SYSTEM-level processes spawned from a standard user session shortly after storage-related IOCTL activity.
Kernel pool corruption events, bugchecks, or KERNEL_MODE_HEAP_CORRUPTION stop codes on hosts missing the patch.
New services, drivers, or scheduled tasks created immediately after suspicious handle opens to storage device objects.

Detection Strategies

Hunt for non-administrative processes opening handles to storage port device objects and issuing large or malformed DeviceIoControl requests.
Correlate local logon events with subsequent token elevation or process integrity level changes to SYSTEM.
Alert on installation of unsigned or newly seen kernel drivers, which is a common follow-on after a local privilege escalation.

Monitoring Recommendations

Ingest Windows Security, Sysmon, and kernel event logs into a centralized SIEM or data lake for cross-host correlation.
Baseline normal storage driver IOCTL patterns per endpoint role to make anomalous access easier to spot.
Monitor patch compliance for the Windows builds listed in the MSRC advisory and flag hosts that fall out of policy.

How to Mitigate CVE-2026-72946

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows systems.
Prioritize patching multi-user systems, jump hosts, and Remote Desktop Services servers where local privilege escalation has the highest impact.
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of authorized attackers.

Patch Information

Microsoft has released fixes as part of its scheduled security update cycle. Consult the Microsoft Security Update Guide for the specific KB articles and build numbers that address the Storage Port Driver heap overflow. Deploy through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or your standard patch management tooling.

Workarounds

No official vendor workaround is documented; patching is the supported remediation path.
Enforce least privilege and restrict local logon on sensitive systems to limit which accounts can reach the vulnerable driver.
Enable attack surface reduction (ASR) rules and driver block-list policies to hinder loading of attacker-supplied kernel components used in exploit chains.

bash

# Verify installation of the latest cumulative update on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm patch compliance across a fleet via PowerShell remoting
Invoke-Command -ComputerName (Get-Content .\hosts.txt) -ScriptBlock {
    Get-HotFix | Where-Object { $_.HotFixID -eq 'KB-REPLACE-WITH-MSRC-KB' }
}