CVE-2026-69643

CVE-2026-69643 is a heap-based buffer overflow (CWE-122) in spaceport.sys, the Windows kernel driver that implements the Storage Spaces storage virtualization feature. An authorized attacker — i.e., one holding low-privilege credentials — can trigger the flaw remotely over a network, and the CVSS vector indicates some form of user interaction is required during the attack. Successful exploitation allows the attacker to elevate privileges on the target system, with high impact on confidentiality, integrity, and availability, which is characteristic of gaining kernel- or SYSTEM-level control. Any Windows system running the vulnerable Spaceport driver is potentially affected; the source data does not specify affected or patched version ranges, so defenders should consult the Microsoft advisory for the applicable editions and fixed builds. As of this analysis there are no known public proofs-of-concept, the CVE is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a ~0.8% chance of exploitation within 30 days (53rd percentile).

What to do: Apply the Microsoft security update for CVE-2026-69643 through Windows Update or your patch management platform, prioritizing multi-user servers and other network-reachable hosts where untrusted users hold low-privilege accounts. Until patched, reduce exposure by restricting interactive logon and authentication rights on Windows systems reachable over the network, since exploitation requires an authorized account plus user interaction. Check the Microsoft advisory for the exact affected and fixed build numbers for each Windows edition in your estate.