CVE-2026-93689 in WinFsp
Summary
by MITRE • 09/18/2026
WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system crash.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in WinFsp versions through 2.26215 represents a critical flaw within the kernel-mode driver component responsible for handling file system operations via Fast I/O mechanisms. Specifically, the defect resides in the device control handler which processes input/output control codes sent by user-space applications to interact with the virtual file system backend. The core technical issue is a null pointer dereference that occurs because the driver fails to perform adequate validation of the volume context structure before attempting to access its members or invoke associated methods. In Windows kernel programming, operations such as Fast I/O device controls often rely on pointers passed from user mode being mapped correctly and pointing to valid, initialized memory structures within the kernel address space. When this assumption is violated due to missing checks, the driver attempts to dereference a null pointer, leading to an immediate exception that the operating system cannot safely recover from in kernel context.
From an operational perspective, this flaw allows any local user with standard privileges to trigger a denial of service condition without requiring administrative rights or elevation of privilege. By opening the WinFsp control device and issuing specific FSP_IOCTL_TRANSACT requests, an attacker can force the driver into executing code paths that access uninitialized memory pointers. The consequence is typically a system crash resulting in a Blue Screen of Death (BSOD) or an automatic reboot if the operating system's fault tolerance mechanisms are engaged but unable to isolate the faulty kernel module. This impacts not only the local machine running WinFsp but also any networked resources dependent on that host, effectively disrupting availability for all users and services relying on the compromised system. The ease of exploitation means that even non-technical actors could disrupt service simply by executing a pre-built payload or script targeting this specific IOCTL code sequence.
In terms of industry-standard classification frameworks, this vulnerability aligns with CWE-476, which denotes a NULL Pointer Dereference, indicating improper handling of null pointers leading to unexpected behavior such as crashes or data corruption. Furthermore, the attack vector falls under MITRE ATT&CK technique T1053, specifically Scheduled Task/Job: Local Job, if leveraged for persistence, but more accurately maps to T1499 Endpoint Denial of Service when considering the direct impact on system availability. The local nature of the exploit means it does not require network exposure or remote code execution capabilities, making it a significant risk in multi-user environments where privilege boundaries are relied upon for security isolation.
Mitigation strategies primarily involve updating WinFsp to version 2.30815 or later, where developers have implemented proper validation checks for volume context pointers before they are utilized by the Fast I/O handler. Until an update is applied, administrators should restrict access to the WinFsp control device using Windows Access Control Lists (ACLs) to limit who can open and issue IOCTL requests against it. Additionally, deploying kernel-level exploit mitigation technologies such as Kernel Patch Protection or enforcing strict driver signing policies can help reduce the attack surface by preventing unauthorized drivers from loading and potentially masking some aspects of memory corruption vulnerabilities. Regular auditing of installed file system filters and ensuring that only trusted applications have permission to interact with virtual drive interfaces are essential steps in maintaining a secure posture against this specific class of kernel-mode flaws.