Executive brief
WinFsp is a Windows file system proxy that allows FUSE-based file systems to run on Windows. An unprivileged local user can crash the system by exploiting a null pointer vulnerability in the kernel driver's device control handler, causing a denial of service.
Technical details
The vulnerability is a null pointer dereference in the Fast I/O device control handler of the WinFsp kernel driver, where the volume context is not validated before use. An attacker with local access can trigger this by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, resulting in a kernel crash.
Affected products
- WinFsp WinFsp through 2.2.26215
Timeline
- 2026-09-18: disclosed