Introduction
An integer overflow in the Windows Storage Spaces Controller gives any locally authenticated user a path to full system privileges, and the attack needs no user interaction. Microsoft disclosed CVE-2026-35415 on May 12, 2026, in a Patch Tuesday cycle that addressed over 120 vulnerabilities. It carries a CVSS base score of 7.8 and affects virtually every supported version of Windows, from Server 2012 R2 through Server 2025 and from Windows 10 through Windows 11 26H1.
Technical information
Root cause: Integer overflow in Storage Spaces Controller
The vulnerability is an integer overflow or wraparound (CWE-190) in the Windows Storage Spaces Controller. An integer overflow happens when an arithmetic operation produces a value that exceeds the range the data type can represent. In a kernel or privileged system component like the Storage Spaces Controller, that can corrupt memory, manipulate internal data structures, and ultimately lead to arbitrary code execution at elevated privilege levels.
CVSS vector breakdown
Microsoft assigned the following CVSS 3.1 vector string:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
The metrics break down as follows:
- Attack Vector (Local): The attacker must already have access to the target system. The flaw is not remotely exploitable on its own.
- Attack Complexity (Low): Triggering the overflow requires no special conditions, race conditions, or extenuating circumstances.
- Privileges Required (Low): Basic user-level access is enough. A standard domain user or local account is sufficient.
- User Interaction (None): The victim does not need to click a link, open a file, or take any other action.
- Impact (High across all three pillars): Successful exploitation has high impact on confidentiality, integrity, and availability. The attacker can read sensitive data, modify system state, and disrupt services.
- Exploitability (Unproven): As of mid-May 2026, no public exploit code exists.
- Remediation Level (Official Fix): Microsoft has released patches.
Attack flow
Based on these characteristics, exploitation would follow this general sequence:
- Initial Access: The attacker gets a low-privilege foothold on a Windows system through any standard initial access technique, such as phishing, compromised credentials, or a web application vulnerability.
- Targeting the Storage Spaces Controller: With local access and basic user privileges, the attacker crafts input that triggers the integer overflow in the Storage Spaces Controller.
- Privilege Escalation: The overflow corrupts memory or manipulates internal data structures, which lets the attacker execute code at elevated privilege levels.
- Full System Compromise: The attacker now has full control over the affected system and can access sensitive data, install persistent backdoors, move laterally, or disrupt operations.
Low attack complexity and no user interaction make this vulnerability particularly attractive for post-exploitation. An attacker who already has a foothold, gained by any means, can chain this flaw to reach full system compromise with minimal effort.
Scope of impact
The vulnerability lives in the Storage Spaces Controller, but the controller is part of the core operating system, so the impact spans the entire Windows ecosystem. Organizations cannot limit patching to dedicated storage servers. Every Windows endpoint and server running an affected version is potentially vulnerable.
Affected systems and versions
The vulnerability affects a broad range of Windows client and server operating systems:
| Product | Platform Variants | Impact | Severity |
|---|---|---|---|
| Windows Server 2012 R2 | Server Core and Standard | Elevation of Privilege | Important |
| Windows Server 2016 | Server Core and Standard | Elevation of Privilege | Important |
| Windows Server 2019 | Server Core and Standard | Elevation of Privilege | Important |
| Windows Server 2022 | Server Core and Standard | Elevation of Privilege | Important |
| Windows Server 2025 | Server Core and Standard | Elevation of Privilege | Important |
| Windows 10 | Versions 1607, 21H2, 22H2 | Elevation of Privilege | Important |
| Windows 11 | Versions 23H2, 24H2, 25H2, 26H1 | Elevation of Privilege | Important |
Organizations should treat this as an operating system update for every Windows machine rather than a targeted component fix. Both Server Core and full desktop installations are affected.
References
- CVE-2026-35415 Detail, National Vulnerability Database (NVD)
- CVE-2026-35415, Microsoft Security Update Guide
- CVE-2026-35415: Confirmed Storage Spaces EoP Flaw, Windows Forum
- Microsoft Patch Tuesday for May 2026, Cisco Talos Intelligence Blog
- Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days, BleepingComputer
- Microsoft Patch Tuesday May 2026: 120 Vulnerabilities Fixed, Cybersecurity News
- Desktop Operating System Market Share Worldwide, StatCounter
