Windows Fast FAT Driver CVE-2026-69347

Exploitation requires that the attacker can cause Windows to mount or parse a crafted FAT filesystem - the most direct path is physical access to insert removable media (USB drive, SD card) that Windows auto-mounts, but a non-privileged local user who can mount a VHD or ISO image containing a FAT volume achieves the same effect. The AC:H rating indicates that the crafted FAT structure must meet specific triggering conditions, meaning exploitation is not trivially reliable. No Windows account credentials are required (PR:N), and the driver parses the volume without requiring the user to interact with any files (UI:N). Exploitation is limited to systems where the Fast FAT driver is active (all supported Windows versions), where the attacker has local physical access or the ability to mount arbitrary disk images, and where the specific heap corruption condition can be reliably triggered in the target kernel build.

The provided CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a kernel-level local privilege escalation with full-system impact potential, but bounded by high attack complexity and the local attack vector. AC:H is meaningful here: the attacker must craft a FAT volume that triggers the exact overflow condition, which requires non-trivial filesystem engineering. PR:N with AV:L is consistent with a physical-access or auto-mount scenario where no Windows credentials are needed. No EPSS data was provided, no KEV listing exists, and no public POC has been identified - so real-world exploitation probability is currently unquantified. The greatest risk is in environments where untrusted removable media is inserted (kiosks, workstations, shared lab machines) or where non-privileged local users can mount arbitrary disk images. For hardened enterprise desktops with removable-media policies enforced, actual exploitability is further constrained. The wide version span (Server 2012 through latest Windows 11 builds) suggests a long-standing driver deficiency rather than a newly introduced regression.

An attacker with physical access to a target workstation inserts a USB drive formatted with a maliciously crafted FAT32 volume containing specially structured metadata designed to trigger the heap overflow in fastfat.sys upon auto-mount. Windows automatically loads the Fast FAT driver to parse the volume without requiring the user to open any files; the overflow corrupts kernel heap memory, and the attacker achieves kernel-mode code execution without any Windows credentials. No public POC exists at time of analysis, so this scenario currently requires significant attacker capability to implement.