{"id":"CVE-2026-119395","kind":"vulnerability","aliases":["CVE-2026-119395"],"related":[],"title":"Windows Storport.sys driver out-of-bounds read leaks information via physical access","description":"Out-of-bounds read in Storport.sys Driver allows an authorized attacker to disclose information with a physical attack.","summary":"Storport.sys, the Windows storage port driver, contains an out-of-bounds read that lets an authorized attacker disclose information. Exploitation requires a physical attack on the machine.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","storage","windows"],"not_affected_if":["no-physical-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:54+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","triaged_at":"2026-11-10T20:04:36+00:00","updated_at":"2026-11-10T20:04:36+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:04:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Storport.sys driver out-of-bounds read leaks information via physical access","impact":"low","summary":"Storport.sys, the Windows storage port driver, contains an out-of-bounds read that lets an authorized attacker disclose information. Exploitation requires a physical attack on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","storage"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads kernel memory contents from the storage driver","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-119395 for affected Windows builds, fixed updates and any mitigations.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-physical-access"],"who_is_affected":"Only machines running Windows with the Storport.sys driver are in scope, and the attacker must already be authorized and have physical access. The sources do not list affected Windows versions or a fix. Systems with physical access controls and full-disk encryption face lower practical risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4495,"output_tokens":445,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119395':16A,19A '-2026':15A,18A 'access':13A 'allow':59C 'attack':40B,47B,62C,69C 'author':39B,61C 'bound':7A,34B,54C 'contain':29B 'cve':14A,17A 'disclos':41B,64C 'driver':3A,28B,58C 'exploit':43B 'inform':10A,42B,65C 'infrastructur':20B 'leak':9A 'let':37B 'machin':50B 'out-of-bound':4A,31B,51C 'physic':12A,46B,68C 'port':27B 'read':8A,35B,55C 'requir':44B 'storag':21B,26B 'storport.sys':2A,23B,57C 'via':11A 'window':1A,22B,25B","nicknames":[],"mitigations":[],"who_affected":"Only machines running Windows with the Storport.sys driver are in scope, and the attacker must already be authorized and have physical access. The sources do not list affected Windows versions or a fix. Systems with physical access controls and full-disk encryption face lower practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","storage","windows"],"campaign_type":null,"search_a":"'-119395':16A,19A '-2026':15A,18A 'access':13A 'bound':7A 'cve':14A,17A 'driver':3A 'inform':10A 'leak':9A 'out-of-bound':4A 'physic':12A 'read':8A 'storport.sys':2A 'via':11A 'window':1A","search_b":"'attack':40B,47B 'author':39B 'bound':34B 'contain':29B 'disclos':41B 'driver':28B 'exploit':43B 'inform':42B 'infrastructur':20B 'let':37B 'machin':50B 'out-of-bound':31B 'physic':46B 'port':27B 'read':35B 'requir':44B 'storag':21B,26B 'storport.sys':23B 'window':22B,25B","search_c":"'allow':59C 'attack':62C,69C 'author':61C 'bound':54C 'disclos':64C 'driver':58C 'inform':65C 'out-of-bound':51C 'physic':68C 'read':55C 'storport.sys':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119395","severity":null,"published_at":"2026-11-10T19:19:54+00:00","modified_at":"2026-11-10T19:19:54+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","fetched_at":"2026-11-10T19:24:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}