Executive brief
Spaceport.sys is a Windows system driver used for hardware device communication and control. An authorized attacker with local system access could exploit an out-of-bounds write vulnerability to execute arbitrary code with kernel-level privileges, potentially leading to complete system compromise and persistent malware installation.
Technical details
This vulnerability is an out-of-bounds write (buffer overflow) in Windows Spaceport.sys, a kernel-mode driver. The flaw allows an attacker with local access and appropriate privilege level to write data beyond allocated buffer boundaries, corrupting kernel memory. By crafting malicious input or API calls to the driver, an attacker can overwrite critical kernel structures and achieve arbitrary code execution at kernel privilege level. Patches are expected to be available from Microsoft; check MSRC for the latest security updates.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed