Windows FASTFAT Driver CVE-2026-85826

Requires local, authenticated access to the target (PR:L) and the ability to make the Fast FAT driver parse attacker-controlled FAT filesystem metadata - in practice mounting or attaching a crafted FAT/FAT32/exFAT-style volume such as a USB device or disk image. Exploitation is limited by high attack complexity (AC:H), implying a race condition or precise memory-grooming requirement that is not reliably repeatable, and by the need for the attacker to already possess valid local credentials or code execution; there is no network vector and no user-interaction-driven remote path. Scope is unchanged (S:U), so impact is confined to the local host's kernel.

This is a legitimate but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local privilege-escalation flaw requiring an already-authenticated low-privileged user AND high attack complexity, which is corroborated by the SSVC decision framework: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=total. These signals are consistent - all point to a high-ceiling impact (full SYSTEM/kernel compromise, reflected in C:H/I:H/A:H) gated behind meaningful preconditions and a non-trivial exploitation path. No EPSS score was provided in the input, and there is no CISA KEV listing and no POC indicator, so there is no public exploit identified at time of analysis. The 7.0 'High' base score is driven almost entirely by the total technical impact, not by ease of exploitation - the AC:H and PR:L metrics substantially dampen real-world risk. This is therefore a patch-in-normal-cycle issue for most environments rather than an emergency, with the caveat that privilege-escalation bugs like this are frequently chained after initial access, so it should still be prioritized on multi-user hosts and endpoints where untrusted users can run code.

A low-privileged but authenticated local user (or malware already running in a limited user context after initial access) supplies or mounts a maliciously crafted FAT-formatted volume - for example a USB device or a VHD/disk image - causing the Windows Fast FAT driver to perform an out-of-bounds write in kernel memory. By grooming kernel memory and winning the required race/timing window (reflected by the high attack complexity), the attacker corrupts kernel structures to elevate to SYSTEM. No public exploit code or active exploitation is identified at time of analysis.