EUVD-2026-99616
GHSA-mf2f-gfpv-3r9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted FAT volume to user
-
ExploitUser mounts/opens malicious image
-
ExecutionTrigger out-of-bounds read in Fast FAT driver
-
ImpactDisclose adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local attack vector plus user interaction: a user must mount, open, or otherwise cause the Windows Fast FAT driver to parse an attacker-crafted FAT/exFAT volume (removable media, disk image, or VHD). No authentication is required (PR:N), but exploitation is limited by the need for that user action (UI:R) and local access - it cannot be triggered remotely or automatically. Impact is confined to information disclosure (C:H, I:N, A:N); there is no code execution or system modification, which materially limits severity. |
| Impact | This is a moderate, not high-priority, issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description's 'disclose information locally': local attack vector, no privileges needed, but user interaction is required, and the only impact is confidentiality (an out-of-bounds read per CWE-125). No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is indicated - so there is no public exploit identified at time of analysis. The signals are coherent rather than conflicting: a local, user-interaction-gated information disclosure with no integrity or availability impact. The elevated C:H rating is the only thing pushing severity up, and real-world risk is tempered by the AV:L + UI:R gating, which means an attacker cannot reach this remotely or without tricking a user into an action. Treat this as routine patch-cycle remediation, not an emergency; absence of EPSS/KEV/POC data should be verified against vendor feeds before final prioritization. |
| Exploit ScenarioDerived | An attacker crafts a malformed FAT/exFAT-formatted volume (e.g., a USB drive, VHD, or disk image) and persuades a local user to mount or open it, causing the Fast FAT driver to read out of bounds and leak adjacent kernel/memory contents. Because the flaw is local with required user interaction and no privileges, exploitation hinges on social engineering or physical/removable-media access. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
RemediationAI
Apply the Microsoft security update referenced in the MSRC Update Guide for CVE-2026-70277 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70277); the advisory's affected-version ranges define the fixed build levels, so Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core) must be brought to at least builds 10.0.14393.9612, 10.0.17763.9376, 10.0.19044.7807, 10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.28000.3231, 10.0.26300.9711, 6.2.9200.26434, 6.3.9600.23470, 10.0.20348.5761 and 10.0.26100.33650 respectively, with the specific KB number taken from the MSRC page for each platform. Because exploitation requires a user to mount or open a malicious FAT/exFAT volume, disk image, or VHD, interim compensating controls are meaningful: disable automatic mounting of new volumes and turn off AutoPlay/AutoRun for removable media so inserted media is not parsed without consent (trade-off: users must manually mount legitimate media and some enterprise imaging workflows will need to whitelist trusted devices), restrict or block end-user attachment of untrusted VHD/VHDX or ISO images via Group Policy or application control (trade-off: blocks legitimate VM and image-handling tasks), and enforce endpoint protection or a removable-media policy that scans or quarantines unknown drives before they are opened, since a crafted image can arrive by physical media, download, or email attachment. If immediate patching is not possible on a system, the most effective single step is to prevent untrusted volumes from being parsed at all - applying these controls removes the user-interaction precondition the vulnerability depends on and reduces exposure to near zero, though it does not remediate the underlying out-of-bounds read and must be reverted once the update is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Fast FAT driver (fastfat.sys) is the Windows kernel-mode file system driver that parses FAT12/FAT16/FAT32 and exFAT on-disk structures for removable media, disk images, and virtual hard disks. Because parsing occurs in kernel context, malformed on-disk metadata - boot sector fields, directory entries, or cluster-chain values - that is not adequately bounds-checked can cause the driver to read beyond the intended buffer, which is the classic CWE-125 out-of-bounds read pattern. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the root issue is confidential-data exposure with no integrity or availability effect and no scope change, meaning the driver reads kernel memory and returns or otherwise surfaces it to the caller rather than corrupting structures. Practically, the attacker supplies a crafted volume image and waits for the victim to mount or browse it; the read does not require any privilege level (PR:N), but the user-interaction component (UI:R) limits the attack to social-engineering or physical-media delivery vectors and rules out remote or fully automatic triggering.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local parsing of an attacker-supplied FAT volume requires user interaction (UI:R, AV:L) but no privileges (PR:N); out-of-bounds read discloses memory (C:H) with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB