Executive brief
A heap-based buffer overflow vulnerability exists in Windows Storage Management Provider that allows an authorized local user to escalate their privileges to a higher level of system access. An attacker who exploits this issue could gain administrative control over the system, enabling them to install malware, steal data, or cause system outages. This requires the attacker to already have local authentication credentials on the affected system.
Technical details
A heap-based buffer overflow in Windows Storage Management Provider can be triggered by an authenticated local attacker to cause memory corruption and execute arbitrary code with elevated privileges. The vulnerability requires local access and prior authentication; it is not remotely exploitable over the network. Successful exploitation results in privilege escalation from a standard user account to system or administrator level.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed