ZDI-26-537: (Pwn2Own) Microsoft Windows storport Integer Overflow Local Privilege Escalation Vulnerability
ZDI discloses a Pwn2Own Windows storport integer overflow local privilege escalation flaw (CVE-2026-65814, CVSS 8.8) requiring existing low-privileged code execution.
ZDI advisory ZDI-26-537 describes an integer overflow in the Microsoft Windows storport driver that allows local attackers to escalate privileges. Exploitation requires the attacker to first obtain the ability to execute low-privileged code on the target system. The vulnerability has a CVSS rating of 8.8 and is tracked as CVE-2026-65814; it originated from Pwn2Own.
28