A heap-based buffer overflow occurs in the Spaceport.sys Windows driver. The flaw allows an attacker with physical or local access to execute arbitrary code on the affected system. The impact is the compromise of confidentiality, integrity, and availability, granting the attacker full control of the machine where the driver runs.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, including both full and Server Core installations.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is not available, so the likelihood of widespread exploitation cannot be quantified from current data, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires local or physical access to the machine; no known remote exploitation path is documented. This means an attacker must be able to access the system physically or via a local user account to load malicious code through Spaceport.sys.