A critical privilege escalation vulnerability in the Windows Storage Spaces Controller exposes multiple versions of Windows 11 and Server 2022 to potential local system compromise.

The flaw is an integer underflow (CWE-191) residing within the Windows Storage Spaces Controller, which can be triggered by a locally authenticated user to manipulate system memory and elevate privileges.

The ability for a local attacker to escalate privileges to a higher level of authority poses a severe risk to organizational security, as it facilitates the bypassing of standard access controls. Given the CVSS score of 7.8, this vulnerability is classified as High severity, enabling an attacker to gain full control over the affected system, potentially leading to unauthorized data access, lateral movement, or complete system takeover.

Immediate Action: Apply the vendor-provided security updates available through the official Microsoft Security Update Guide.

Proactive Monitoring: Review local system logs for unusual process execution or attempts to access restricted kernel-level components.

Compensating Controls: Restrict local user access and enforce the principle of least privilege to minimize the number of accounts capable of interacting with the vulnerable controller.

Public Exploit Available: No (exploit_available: false)

Due to the potential for full system compromise via privilege escalation, immediate patching is highly recommended for all affected Windows environments. Administrators should prioritize the deployment of the latest security updates to all Windows 11 and Server 2022 instances to mitigate this risk effectively.