CVE-2026-72952: Windows Spaceport.sys RCE Vulnerability

CVE-2026-72952 Overview

CVE-2026-72952 is an out-of-bounds read vulnerability [CWE-125] in the Windows Spaceport driver (Spaceport.sys). The flaw allows an authorized local attacker to execute code on the affected system. Spaceport is the Microsoft Storage Spaces driver responsible for managing virtualized storage pools on Windows.

Successful exploitation requires local access and low privileges but has high attack complexity. Impact spans confidentiality, integrity, and availability once the vulnerability is triggered.

Critical Impact
An authorized local attacker can leverage the out-of-bounds read in Spaceport.sys to achieve local code execution, potentially at elevated privilege due to the driver operating in kernel context.

Affected Products

Microsoft Windows (Spaceport driver Spaceport.sys)
Refer to the Microsoft CVE-2026-72952 Update Guide for the definitive list of affected builds
Windows systems using Storage Spaces functionality

Discovery Timeline

2026-09-08 - CVE-2026-72952 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72952

Vulnerability Analysis

The vulnerability resides in Spaceport.sys, the kernel-mode driver that implements Windows Storage Spaces. An out-of-bounds read occurs when the driver processes attacker-influenced input and accesses memory beyond an allocated buffer boundary.

Because the flaw lives in a kernel driver, information read past the buffer can include sensitive kernel structures, pool metadata, or pointers. An attacker who chains the read primitive with additional logic can transform it into a local code execution primitive within the kernel context.

Exploitation requires the attacker to already hold a low-privileged account on the target system. The CVSS vector indicates high attack complexity, meaning reliable exploitation depends on specific runtime conditions such as memory layout or timing.

The EPSS score is 0.252%, reflecting a low predicted probability of public exploitation activity in the immediate term. No public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is an improper bounds check within Spaceport.sys when handling structured input to the driver. Under [CWE-125], the driver reads from a memory location outside the intended buffer, exposing adjacent kernel memory to the caller and enabling downstream corruption or leakage of security-relevant data.

Attack Vector

The attack vector is local. An authenticated attacker interacts with the Spaceport driver through the standard I/O request path available to user-mode processes, typically via device control (DeviceIoControl) calls against a Storage Spaces device object.

The attacker crafts input that triggers the out-of-bounds read, then uses the leaked data or resulting corruption to steer execution. Because no user interaction is required and the scope is unchanged, the exploit chain runs entirely from the attacker's local session.

See the Microsoft CVE-2026-72952 Update Guide for vendor technical details. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-72952

Indicators of Compromise

Unexpected loading or interaction with Spaceport.sys by non-system processes
Kernel bugchecks or stop errors referencing Spaceport.sys following user-mode activity
Unusual DeviceIoControl calls from low-privileged processes targeting Storage Spaces device objects
Presence of new local user accounts or scheduled tasks created shortly after suspicious driver interaction

Detection Strategies

Monitor for anomalous handle opens to Storage Spaces device paths from processes that do not typically manage storage
Correlate Windows Error Reporting (WER) crash dumps mentioning Spaceport.sys with recent process activity to identify exploitation attempts
Baseline expected callers of Storage Spaces IOCTLs and alert on deviations from that baseline

Monitoring Recommendations

Enable kernel-mode crash dump collection and forward dumps to a central analysis pipeline
Ingest Sysmon Event ID 6 (driver load) and process creation events into your SIEM for correlation
Track privilege changes and process token elevations following interaction with kernel storage components

How to Mitigate CVE-2026-72952

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72952 Update Guide as soon as it is available for your Windows build
Inventory systems with Storage Spaces enabled and prioritize patching multi-tenant or shared workstations
Restrict local logon rights on high-value systems to reduce the pool of potential attackers

Patch Information

Microsoft publishes patch availability and affected build information through the Microsoft Security Response Center (MSRC). Consult the Microsoft CVE-2026-72952 Update Guide for the current list of security updates, KB numbers, and product coverage. Deploy updates through Windows Update, WSUS, or your enterprise patch management tooling.

Workarounds

No official vendor workaround has been published; the security update is the authoritative remediation
Where patching is delayed, limit local interactive and remote logon rights to trusted administrators
Disable Storage Spaces on systems that do not require the feature to reduce the attack surface of Spaceport.sys
Apply application control policies (for example, Windows Defender Application Control) to block unauthorized binaries from executing on affected hosts

bash

# Example: check whether Storage Spaces is in use via PowerShell
Get-StoragePool | Where-Object { $_.IsPrimordial -eq $false }

# Example: confirm installed security updates on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20