Executive brief
Windows Storage Spaces Controller is a system component that manages storage configuration and redundancy on Windows servers and workstations. A heap-based buffer overflow in this component allows an authorized local attacker to execute arbitrary code with elevated privileges, potentially compromising the entire system and any data stored on managed storage arrays.
Technical details
A heap-based buffer overflow vulnerability exists in the Windows Storage Spaces Controller component. The vulnerability is triggered during local code execution by an authenticated attacker who has sufficient privileges on the affected system. Successful exploitation allows arbitrary code execution in the context of the Storage Spaces Controller process. An attacker must have local access and appropriate authorization to trigger the vulnerable code path. Microsoft has released security updates to address this vulnerability.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed