Executive brief
The Storage Port Driver is a Windows system component that manages communication with storage devices. An authorized attacker with local access to a computer can trigger an out-of-bounds memory read to extract sensitive information from system memory, potentially exposing confidential data or aiding further attacks.
Technical details
The vulnerability is an out-of-bounds read in the Storage Port Driver (storport.sys), a core Windows kernel-mode driver responsible for storage device communication. An authenticated local attacker can craft specific requests or manipulate driver state to trigger an out-of-bounds memory access. The flaw allows reading adjacent kernel memory, potentially disclosing sensitive information such as credentials, encryption keys, or other system secrets. Exploitation requires local access and appropriate privileges; remote exploitation is not possible. Microsoft has released patches to address this vulnerability.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed