Microsoft Windows StorPort Driver Vulnerable to Local Privilege Escalation
A local privilege escalation vulnerability in Microsoft Windows' storport driver, CVE-2026-65814, allows attackers with low-privileged code execution to gain SYSTEM privileges.
Researchers from Viettel Cyber Security have identified a critical local privilege escalation vulnerability within the Microsoft Windows storport driver. This flaw, cataloged as CVE-2026-65814, requires an attacker to first achieve low-privileged code execution on the target system before it can be exploited.
The vulnerability stems from an integer overflow within the storport driver, which occurs due to a lack of proper validation of user-supplied data. This overflow can lead to a buffer write with insufficient bounds, allowing an attacker to escalate their privileges to the SYSTEM level and execute arbitrary code.
The Zero Day Initiative (ZDI), which coordinated the disclosure, assigned a CVSS score of 8.8 to this vulnerability, highlighting its severity. Successful exploitation could grant an attacker complete control over an affected Windows system, enabling them to install programs, view, alter, or delete data, and create new accounts with full user rights.
Microsoft has acknowledged the vulnerability and released a patch as part of its security updates. Users are strongly advised to apply the latest security updates provided by Microsoft to mitigate the risk of exploitation. The advisory can be found at Microsoft's Update Guide.
The disclosure timeline indicates that the vulnerability was reported to the vendor on May 21, 2026, with a coordinated public release of the advisory on August 11, 2026. This timeline adheres to industry standards for responsible disclosure, allowing vendors adequate time to develop and distribute patches.
The discovery and reporting of this vulnerability are credited to Le Tran Hai Tung, dungnm, and hieuvd from Viettel Cyber Security. Their work underscores the ongoing efforts by security researchers to identify and address critical flaws in widely used operating systems.
This vulnerability adds to the ongoing landscape of privilege escalation issues affecting Windows, emphasizing the importance of timely patching and robust endpoint security measures. Attackers continuously seek such vulnerabilities to gain deeper access to systems after initial, less privileged entry points are compromised.