CVE-2026-69381 — Windows Storage Port Driver Information Disclosure Vulnerability

Executive Summary

Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack.

Overview

4.6

CVSS MEDIUM

Important

MS Severity

Not Exploited

MS Exploit Status

Exploitation Unlikely

MS Exploit Likelihood

Category Information Disclosure

Weakness CWE-125: Out-of-bounds Read

Released Sep 8 2026

Last Updated Sep 8 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

CVSS Vector

ATTACK VECTOR

Physical

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

None

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

None

AVAILABILITY

None

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 4.0

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

30 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1607 for 32-bit Systems	`5123099 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 1607 for x64-based Systems	`5123099 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 1809 for 32-bit Systems	`5122876 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 1809 for x64-based Systems	`5122876 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 21H2 for x64-based Systems	`5122878 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Information Disclosure	Yes
Windows 10 Version 22H2 for x64-based Systems	`5122878 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5122880 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 23H2 for x64-based Systems	`5122880 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 24H2 for x64-based Systems	`5124008 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 25H2 for x64-based Systems	`5124008 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 Version 26H1 for ARM64-based Systems	`5124012 (Security Update)`	Important	Information Disclosure	Yes
Windows 11 version 26H1 for x64-based Systems	`5124012 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2012	`5123065 (Monthly Rollup)`	Important	Information Disclosure	Yes
Windows Server 2012 (Server Core installation)	`5123065 (Monthly Rollup)`	Important	Information Disclosure	Yes
Windows Server 2012 R2	`5123066 (Monthly Rollup)`	Important	Information Disclosure	Yes
Windows Server 2012 R2 (Server Core installation)	`5123066 (Monthly Rollup)`	Important	Information Disclosure	Yes
Windows Server 2016	`5123099 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2016 (Server Core installation)	`5123099 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2019	`5122876 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2019 (Server Core installation)	`5122876 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2022	`5122882 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2022 (Server Core installation)	`5122882 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2025	`5122871 (Security Update)`	Important	Information Disclosure	Yes
Windows Server 2025 (Server Core installation)	`5122871 (Security Update)`	Important	Information Disclosure	Yes

Patches

10 patches

Article	Type	Restart
`5123099`	Security Update	Yes
`5122876`	Security Update	Yes
`5122878`	Security Update	Yes
`5122880`	Security Update	Yes
`5124008`	Security Update	Yes
`5124012`	Security Update	Yes
`5123065`	Monthly Rollup	Yes
`5123066`	Monthly Rollup	Yes
`5122882`	Security Update	Yes
`5122871`	Security Update	Yes

Patch Diff

ghidriff · storport.sys (KB5124008)

Out-of-bounds read (CWE-125) in the Windows Storage Port Driver storport.sys device-ID descriptor builder, kernel-memory information disclosure via a malicious attached storage device (Important, Information Disclosure, AV:P/AC:L/PR:N/UI:N, C:H/I:N/A:N, CVSS 4.6; Exploitation Unlikely). When a user-mode caller issues IOCTL_STORAGE_QUERY_PROPERTY for StorageDeviceIdProperty, storport builds a STORAGE_DEVICE_ID_DESCRIPTOR in ReplaceDeviceId from the device-returned SCSI VPD page 0x83 (device identification) data: it walks the identification descriptors in the device buffer, taking each descriptor's length from its header byte (pbVar[3]) and copying that many bytes (memcpy(dst, pbVar+4, pbVar[3])), advancing by 4 + pbVar[3]. PRE: the walk used only the device-declared page length as the loop bound and did not verify that each descriptor header and its body stayed within the buffer, so a crafted device that returns a VPD 0x83 page whose (last) descriptor length runs past the declared page reads past the end of the device buffer and copies adjacent kernel memory into the output descriptor - an out-of-bounds read that discloses kernel memory to the user-mode caller (per the MSRC FAQ: 'Kernel memory read ... from a user mode process'). Because it requires the attacker to attach a malicious storage device, Microsoft scores it AV:P (physical). Diff of storport.sys 10.0.26100.9278 -> .9444 (Sep 8 2026, KB5124008, 24H2/25H2) confirms the fix: gated behind a velocity feature check (helper unsymbolized in this diff as FUN_14009362c), ReplaceDeviceId now clamps the usable length (pagelen + 4 capped at 0xffff, bounded by the caller buffer) and, per descriptor, breaks out of the parse when the next header (uVar10 < uVar7 + 4) or the descriptor body (uVar10 < pbVar9[3] + 4 + uVar7) would exceed that bound - stopping the copy before it reads past the device buffer. Confirmation level: the vulnerable function and the added bounds checks are cleanly isolable in the diff; the exact freed/adjacent allocation read is not asserted beyond 'reads past the device-supplied VPD buffer'. Note: this Sep-2026 storport build recompiled ~300 functions; the security-relevant code change for this CVE is ReplaceDeviceId (the device-ID descriptor walk).

Pre-patch version 10.0.26100.9278 Download

Post-patch version 10.0.26100.9444 Download

Function	Address	Change	Note
`ReplaceDeviceId`	`code change`	code (adds per-descriptor bounds checks on the VPD 0x83 device-ID walk, velocity-gated)	Builds STORAGE_DEVICE_ID_DESCRIPTOR from the device's VPD page 0x83 identification descriptors. Pre: looped over descriptors using pbVar[3] as each length and memcpy'd pbVar[3] bytes, bounded only by the device-declared page length, with no check that a descriptor header/body stays in-buffer. Post (velocity-gated, helper FUN_14009362c): clamps the usable length (pagelen+4, capped 0xffff, min with caller buffer -> uVar10) and breaks when uVar10 < uVar7 + 4 (header) or uVar10 < pbVar9[3] + 4 + uVar7 (body) before reading/advancing, stopping the OOB read. In the post binary the function symbol was not resolved (shown as FUN_1400c3410); it is an Implied Match to ReplaceDeviceId.
`velocity feature check (FUN_14009362c)`	`gate`	gate (velocity/CFR feature check, unsymbolized)	The new bounds checks in ReplaceDeviceId run only when this feature helper returns nonzero; the original unchecked walk runs when disabled. The helper is unsymbolized in this diff (FUN_14009362c), so the numeric Feature_<id> is not resolved here.

View full diff report View RCA report

Attack Path

A malicious attached storage device returns a VPD device-ID page whose descriptor length runs past the buffer, making storport read out of bounds into the query output

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

Kangjun Heo

References

MSRC Advisory MITRE NVD