Windows Fast FAT Driver CVE-2026-68878

The attacker must hold at minimum a low-privilege authenticated account on the target system or network (PR:L per CVSS vector). User interaction is required (UI:R per CVSS vector) - a user on the target system must actively access or mount a FAT file system resource controlled or influenced by the attacker, such as a crafted network share. The attack is delivered over the network (AV:N), most plausibly via SMB-based network shares where fastfat.sys processes the FAT content. Exploitation is limited by: (1) the attacker must be authenticated with at least low privileges; (2) a local user on the target system must interact with the malicious FAT content; (3) network access to the target's file-sharing interface (typically TCP 445) is required. Systems that block inbound SMB, restrict share access to trusted users only, or do not mount remote FAT volumes have meaningfully reduced exposure.

The CVSS 8.0 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects meaningful real-world risk: a low-privilege authenticated attacker can achieve full system compromise with low attack complexity. The network attack vector is significant for a kernel FAT driver, as SMB-based network share access routinely invokes fastfat.sys on Windows systems, expanding the practical attack surface well beyond purely local scenarios. The UI:R requirement introduces a meaningful exploitation barrier - an attacker must cause a user on the target system to interact with a malicious FAT resource - limiting fully automated, worm-style propagation. The S:U (Unchanged scope) scoping confirms the privilege escalation is contained within the compromised host rather than crossing into adjacent systems directly. No CISA KEV listing was identified at time of analysis, and no public exploit code has been confirmed, which tempers immediate urgency. However, the breadth of affected versions - from legacy Windows Server 2012 to current Server 2025 - means even a mid-sized municipal IT team in gniezno managing heterogeneous Windows fleets should treat this as urgent patching work, particularly where SMB/file-share services are accessible to low-trust authenticated users. EPSS data was not provided, preventing a probability-of-exploitation estimate; given the kernel-level exploitation complexity and UI:R barrier, real-world exploitation is assessed as non-trivial despite the low CVSS complexity rating.

An authenticated attacker with a low-privilege domain or local account navigates to or triggers a user on the target Windows system to mount or browse a network share hosting a specially crafted FAT-formatted volume. The malformed FAT structures cause fastfat.sys to overflow a kernel-mode stack buffer, overwriting a return address with an attacker-controlled value and diverting execution to shellcode running at SYSTEM privilege. No public proof-of-concept exists at time of analysis, but the well-understood CWE-121 overflow class and the network accessibility of the FAT driver via SMB make this a viable target for skilled kernel exploit developers.