Windows Storage Spaces Controller: Heap overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Storage Spaces Controller allows an authorized local user with low privileges to elevate their privileges. Successful exploitation can give full control of the affected system. The attacker needs local access and an existing user account; the vulnerability is not reachable remotely from the internet. Microsoft rates exploit maturity as unproven.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows Server 2022: builds before 10.0.20348.5761
• Source data is not fully consistent for some entries; confirm builds on the MSRC page.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376
• Windows 11 Version 24H2: 10.0.26100.9711
• Other versions: see the fixed builds listed in the affected section and the Microsoft advisory. KB number: Unknown.

Workaround

Unknown. No workaround is documented; patching is the only documented fix.

Exploitation

• Microsoft rates exploit maturity as unproven.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept or in-the-wild exploitation was found in the sources reviewed.

Our recommendation

• Install the Microsoft security update for each affected Windows version as soon as possible, prioritising multi-user systems such as terminal servers and file servers.
• Verify the CVSS score in NVD before reporting, as sources differ (7.8 versus 6.7).
• Limit local logon on affected hosts and check whether Storage Spaces is actually in use.
• Windows 10 Version 1607 is an old build; verify its end-of-support date on Microsoft's lifecycle page and plan a migration if no extended support applies.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88143 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-88143 msrc.microsoft.com
• Vulners CVE record (CNA data) vulners.com
• Vulners MSCVE record (fixed builds) vulners.com
• OpenCVE: CVE-2026-88143 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:16.