Windows Spaceport.sys: Heap-based buffer overflow allows local code execution

Summary

A heap-based buffer overflow in the Windows Spaceport.sys kernel driver affects supported Windows 10, Windows 11 and Windows Server systems. An authorized local attacker with low privileges can execute code, which could lead to full system compromise (CVSS 3.1: 7.8). The attack is not remotely exploitable, so the main risk is a user or service account already on a machine gaining code execution, for example after phishing or a credential compromise.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2: see the Microsoft advisory for the exact builds
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33650

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376 (update listed as KB5126651, to be confirmed on the Microsoft advisory page)
• Windows 10 Version 22H2: 10.0.19045.7807
• Other versions: see the fixed builds in the Microsoft advisory

Workaround

• No workaround is provided by Microsoft. Install the security update.
• Interim risk reduction only, not a fix: restrict local privileged access to the Spaceport.sys driver and enforce least privilege for local accounts.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• Microsoft exploit maturity: Unproven (E:U).
• No public proof of concept found; absence of evidence is not proof.
• Not listed in the CISA KEV catalogue.
• EPSS: 0.00341 (very low).

Our recommendation

• Apply the October 2026 cumulative security update on all affected Windows systems, prioritising shared workstations, terminal servers and Windows 10 1809 / Server 2019 systems still in service.
• Check your inventory for Windows 10 1809 and Server 2019 systems and confirm whether Windows 10 systems are on an extended security update plan.
• Enforce least privilege and review local administrator accounts.
• Monitor for suspicious local code execution and for updates to the Microsoft advisory.
• Related Spaceport.sys CVEs from September and October 2026 are covered by the same monthly update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70112 msrc.microsoft.com
• vulners: CVELIST CVE-2026-70112 vulners.com
• OpenCVE: CVE-2026-70112 app.opencve.io
• vulners: NVD CVE-2026-70112 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:11.