The Windows Storage Port Driver contains a flaw that allows an out-of-bounds read. An unauthorized attacker who can physically access a machine can trigger a path that causes the driver to read beyond its allocated buffer, potentially exposing arbitrary system memory and sensitive data. This flaw follows the common CWE-125 classification.

Affected components include multiple Microsoft Windows client releases – Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1, 23H2, 26H2) as well as a range of Windows Server editions from 2012 through 2025, including their Server Core and Core installation variants. The vulnerability is present in the Windows Storage Port Driver across both x86 and x64 architectures, and in the ARM64 builds of Windows 11.

The CVSS score of 4.6 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting current exploitation is unlikely and rapidly mitigated. An attacker must gain physical access to the target device to exploit this out‑of‑bounds read; therefore, the threat is limited to scenarios where physical security is breached or an insider has full system access. The fix is to apply the vendor’s update; until that patch is in place, mitigating the exposure relies on stringent physical controls and disabling unnecessary storage port functionality.