A heap-based buffer overflow in the Windows Storage Spaces Controller permits an authorized local attacker to gain elevated privileges on the host. The flaw can be triggered by manipulating internal data structures within the controller, leading to an attacker potentially achieving SYSTEM-level rights. The vulnerability directly jeopardizes confidentiality, integrity, and availability of the affected system for the user account that initiates the exploit.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). All versions include the Windows Storage Spaces Controller component that is susceptible to the overflow.

The not‑yet‑available EPSS score prevents an exact estimate of current exploitation probability, but the CVSS score of 7.8 indicates a high severity local impact. Because the flaw requires an attacker with local access and some level of authorization, the threat is focused on users who can log into or have physical access to the machine. The vulnerability is not listed in the CISA KEV catalog, which may indicate a lower observed exploitation prevalence at the time of analysis, yet the high CVSS suggests that attackers could reasonably expect success on vulnerable systems.