CVE-2025-24985
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
Analysis
An integer overflow in the Windows Fast FAT Driver allows unauthenticated local code execution through crafted FAT filesystem images. KEV-listed with public PoC, this vulnerability (CVE-2025-24985) can be triggered by mounting a malicious USB drive or VHD file, making it a potent vector for physical access attacks and social engineering scenarios.
Technical Context
The Windows Fast FAT filesystem driver (fastfat.sys) fails to properly validate integer arithmetic when processing FAT directory entries. An attacker-controlled integer value overflows during size calculation, resulting in an undersized kernel pool allocation. Subsequent data copy overwrites adjacent kernel memory. Because filesystem drivers operate in kernel mode, successful exploitation yields SYSTEM-level code execution.
Affected Products
['Microsoft Windows 10 (all versions)', 'Microsoft Windows 11', 'Microsoft Windows Server 2016/2019/2022']
Remediation
Apply Microsoft security update immediately. Disable AutoPlay for removable media. Consider blocking VHD file attachments at email gateway. Group Policy: restrict mounting of removable media on sensitive systems.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today