Microsoft Fixes Multiple Windows Elevation of Privilege Flaws

Microsoft published security updates for several Windows elevation of privilege vulnerabilities affecting core components, including Windows Storage Spaces Controller, Windows SMB Client, and Windows Speech Runtime. The issues were tracked as CVE-2026-27907, CVE-2025-32718, and CVE-2025-58715, respectively, and all could allow attackers to gain higher privileges on affected systems after initial access.

Among the disclosed flaws, Microsoft provided the most detail for CVE-2026-27907, describing it as an integer underflow issue (CWE-191) in Windows Storage Spaces Controller that could let a locally authenticated low-privileged attacker elevate privileges to SYSTEM without user interaction. Microsoft rated that vulnerability Important with a CVSS 3.1 score of 7.8, said it was not publicly disclosed or exploited at publication, assessed exploitation as less likely, and released an official fix as part of its security guidance.