CVE-2026-77492: Storage Port Driver Information Disclosure

CVE-2026-77492 Overview

CVE-2026-77492 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Storage Port Driver. An authorized local attacker can exploit the flaw to disclose sensitive information from kernel memory. The vulnerability requires local access and low privileges, with no user interaction needed to trigger the condition.

Microsoft published the advisory through the Microsoft Security Update Guide. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact
A local authenticated attacker can read out-of-bounds kernel memory through the Storage Port Driver, potentially exposing sensitive data that supports further privilege escalation or lateral movement.

Affected Products

Microsoft Windows Storage Port Driver (storport.sys)
Specific affected Windows builds are enumerated in the Microsoft Security Update Guide
Refer to Microsoft's advisory for the authoritative product and build list

Discovery Timeline

2026-09-08 - CVE-2026-77492 published to the National Vulnerability Database
2026-09-08 - Microsoft advisory published in the Security Update Guide
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77492

Vulnerability Analysis

The Storage Port Driver mediates I/O requests between the Windows storage stack and miniport drivers for physical storage devices. It runs in kernel mode and processes buffers supplied through I/O control codes (IOCTLs) and internal storage request packets.

This vulnerability is an out-of-bounds read [CWE-125]. The driver reads memory beyond the intended boundary of an allocated buffer during storage request handling. The out-of-bounds data can then be returned to the caller or reflected through other kernel objects accessible to the attacker.

The confidentiality impact is high, while integrity and availability remain unaffected. Successful exploitation discloses kernel memory contents that may include pointers, tokens, or other sensitive artifacts useful for bypassing kernel address space layout randomization (KASLR) or chaining with additional flaws.

Root Cause

The root cause is missing or incorrect boundary validation on a buffer or length field processed by the Storage Port Driver. When the driver computes a read offset or size from attacker-influenced input without proper bounds checking, it accesses memory outside the intended allocation. Microsoft has not released implementation-level details of the affected code path.

Attack Vector

Exploitation requires local access with low-privilege credentials on the target system. An attacker executes code that issues crafted storage-related requests to the driver, then reads back the returned data to harvest kernel memory contents. No user interaction is required, and the attack does not cross a security boundary beyond the local machine.

No verified public exploit code is available. See the Microsoft Security Update Guide for vendor-supplied technical detail.

Detection Methods for CVE-2026-77492

Indicators of Compromise

Unexpected user-mode processes issuing high volumes of storage IOCTLs to \\.\Storage or physical drive handles
Kernel memory disclosure artifacts appearing in user-mode process memory or written to disk by non-administrative accounts
Unsigned or newly introduced binaries interacting with storport.sys on endpoints that do not run storage management tooling

Detection Strategies

Baseline expected callers of storage-management APIs and alert on deviations, particularly from non-administrative users
Correlate local privilege-escalation attempts with prior anomalous storage IOCTL activity
Hunt for tools or scripts that repeatedly invoke DeviceIoControl against storage device handles from unusual parent processes

Monitoring Recommendations

Enable Windows kernel-mode event tracing for storage stack activity and forward to a central analytics platform
Monitor Sysmon Event ID 1 (process creation) for unexpected binaries running with SeDebugPrivilege or accessing storage devices
Track patch compliance for the affected Windows builds identified in the Microsoft advisory

How to Mitigate CVE-2026-77492

Immediate Actions Required

Apply the Microsoft security update referenced in the Security Update Guide as soon as testing permits
Prioritize patching on multi-tenant hosts, terminal servers, and VDI systems where untrusted users hold local sessions
Restrict interactive and remote logon rights to reduce the population of accounts that can reach the local attack surface

Patch Information

Microsoft has released a security update addressing CVE-2026-77492. Consult the Microsoft Security Update Guide for the specific KB articles, affected Windows builds, and updated storport.sys versions applicable to your environment.

Workarounds

No vendor-supplied workaround is documented; patching is the supported remediation path
Enforce least-privilege policies and remove unnecessary local accounts to reduce exploitation opportunity
Apply application allow-listing to block unauthorized binaries from executing kernel-facing IOCTLs

bash

# Verify the installed storport.sys version on a Windows host
powershell -Command "Get-Item C:\Windows\System32\drivers\storport.sys | Select-Object VersionInfo"

# List installed security updates to confirm patch deployment
wmic qfe list brief /format:table