CVE-2026-69535

CVE-2026-69535 is a numeric truncation error (CWE-197) in spaceport.sys, the Windows Storage Spaces driver, that Microsoft rates High severity (CVSS 3.1: 7.8) for local privilege elevation. An attacker who already holds valid low-privileged access on a local Windows host can trigger the truncation error, causing kernel-mode memory corruption consistent with a heap-based buffer overflow (CWE-122). Successful exploitation yields full elevation of privilege, with high impact on confidentiality, integrity, and availability (SYSTEM-level control of the host). All Windows editions that ship the affected spaceport.sys driver are potentially affected; the available data does not specify exact Windows version ranges, so defenders should consult Microsoft's advisory for the definitive build list. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% (16th percentile) probability of exploitation within 30 days, indicating no known exploitation at this time.

What to do: Track Microsoft's advisory (MSRC/CNA [email protected]) for the exact affected builds and apply the corresponding Windows security update as soon as it is released, then verify the patched spaceport.sys file version on critical hosts. Until patched, restrict local logon and RDP access to trusted users and remove standard-user local access on sensitive servers to shrink the attack surface. Given the lack of public PoC and low EPSS (0.2%), patch end-user devices within normal cycles and prioritize multi-user or remotely-accessed Windows systems first.