CVE-2026-72952 in Windows
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-38069 represents a critical security flaw within the Microsoft Windows operating system, specifically residing in the kernel-mode driver known as spaceport.sys. This component is integral to the management of virtualized environments and containerization technologies on Windows platforms, particularly those involving Hyper-V or related isolation mechanisms. The core technical nature of this vulnerability is an out-of-bounds read error, which falls under the Common Weakness Enumeration category CWE-125. In practical terms, this means that during specific operations handled by spaceport.sys, the driver fails to properly validate memory access boundaries before reading data from a buffer. When an attacker triggers these conditions through crafted inputs or maliciously constructed requests directed at the service, the system attempts to read memory locations beyond the allocated limits of the intended buffer.
While out-of-bounds reads are traditionally associated with information disclosure vulnerabilities where sensitive kernel memory contents might be leaked to user space, Microsoft has classified this specific instance as allowing for local code execution. This classification suggests that the manner in which the invalid memory access occurs can lead to further exploitation chains beyond simple data leakage. By manipulating the state of the system through these improper reads, an authenticated attacker may achieve arbitrary code execution within the context of the operating system kernel or a highly privileged process. The requirement for authentication implies that the attack vector is local, meaning the adversary must already have valid credentials on the target machine and potentially need to bypass certain access controls to interact with the vulnerable component. This aligns with ATT&CK technique T1059, which covers command and script interpretation, as well as potential privilege escalation paths if the execution context allows for elevation of privileges from a lower-privileged user account to SYSTEM level.
The operational impact of this vulnerability is severe due to its location within kernel-mode code. Successful exploitation grants an attacker full control over the affected system, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights. Because spaceport.sys handles interactions related to virtualization and container management, systems running workloads that utilize these features are at higher risk of being targeted if they remain unpatched. The ability to execute code locally without requiring physical access or remote network interaction makes this a significant threat for insider threats or attackers who have gained initial foothold through other means such as phishing or exploiting less secure perimeter defenses.
Mitigation strategies primarily rely on the timely application of security updates provided by Microsoft. Organizations should ensure that all Windows endpoints, particularly those hosting virtual machines or containerized applications, are updated to include the patches addressing CVE-2024-38069. Beyond patching, defense-in-depth measures such as enabling Kernel Patch Protection (PatchGuard) and Data Execution Prevention can help mitigate some exploitation attempts by restricting where code can be executed in memory. Additionally, enforcing strict least-privilege principles for user accounts reduces the likelihood of an attacker gaining the necessary authentication level to trigger this vulnerability. Monitoring system logs for unusual activity related to spaceport.sys or unexpected kernel-mode operations can also aid in early detection and response efforts against potential exploitation attempts.