CVE-2026-68878 — Windows Fast FAT Driver Elevation of Privilege Vulnerability

Executive Summary

Stack-based buffer overflow in Windows Fast FAT Driver allows an authorized attacker to elevate privileges over a network.

Overview

8

CVSS HIGH

Important

MS Severity

Not Exploited

MS Exploit Status

Less Likely

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-121: Stack-based Buffer Overflow

Released Sep 8 2026

Last Updated Sep 8 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

CVSS Vector

ATTACK VECTOR

Network

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

Low

USER INTERACTION

Required

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 7.0

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

30 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1607 for 32-bit Systems	`5123099 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1607 for x64-based Systems	`5123099 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for 32-bit Systems	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for x64-based Systems	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for x64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for x64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5122880 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for x64-based Systems	`5122880 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for x64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for x64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 26H1 for ARM64-based Systems	`5124012 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 version 26H1 for x64-based Systems	`5124012 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2012	`5123065 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2012 (Server Core installation)	`5123065 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2012 R2	`5123066 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2012 R2 (Server Core installation)	`5123066 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2016	`5123099 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2016 (Server Core installation)	`5123099 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019 (Server Core installation)	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022	`5122882 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022 (Server Core installation)	`5122882 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025	`5122871 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025 (Server Core installation)	`5122871 (Security Update)`	Important	Elevation of Privilege	Yes

Patches

10 patches

Article	Type	Restart
`5123099`	Security Update	Yes
`5122876`	Security Update	Yes
`5122878`	Security Update	Yes
`5122880`	Security Update	Yes
`5124008`	Security Update	Yes
`5124012`	Security Update	Yes
`5123065`	Monthly Rollup	Yes
`5123066`	Monthly Rollup	Yes
`5122882`	Security Update	Yes
`5122871`	Security Update	Yes

Patch Diff

ghidriff · fastfat.sys (KB5124008)

Stack-based buffer overflow (CWE-121) in the Windows Fast FAT Driver fastfat.sys FAT-run writer, elevation of privilege to SYSTEM (Important, EoP, AV:N/AC:L/PR:L/UI:R, C:H/I:H/A:H, CVSS 8.0; Exploitation Less Likely). FatSetFatRun writes a run of FAT entries by pinning the FAT pages that the run spans into a fixed-size on-stack array (local_468, room for ~0x42 = 66 pinned-page BCB/buffer slots) and iterating over them. The number of pages is derived from the run's starting FAT offset and length: iVar4 = (end>>0xC) - (start>>0xC) and the loop runs uVar5 = iVar4 + 1 times, each writing local_468[i*2] and local_468[i*2+1]. PRE: uVar5 was not bounded, so a crafted FAT volume / crafted file layout that makes a FAT run span more than 65 4KB FAT pages drives the loop past the end of local_468 - a stack buffer overflow in kernel context, giving a SYSTEM elevation primitive. Diff of fastfat.sys 10.0.26100.9278 -> .9444 (Sep 8 2026, KB5124008, 24H2/25H2) confirms the fix: gated behind CFR flag Feature_3174802747, FatSetFatRun computes uVar5 = iVar4 + 1 and, before the memset/pin loop, checks if (0x41 < uVar5) - i.e. more than 65 pages - and raises STATUS_FILE_CORRUPT_ERROR (0xC0000102) via ExRaiseStatus instead of overrunning the stack array. This is the CWE-121 stack-overflow / EoP of the pair; the sibling heap overflow is CVE-2026-69347 (FatSetupAllocationSupport, Feature_4205292859). Note: the same Sep-2026 fastfat build also hardens an unrelated EFS FSCTL parsing path (Feature_709593401 / Feature_591104313), not attributed to this CVE.

Pre-patch version 10.0.26100.9278 Download

Post-patch version 10.0.26100.9444 Download

Function	Address	Change	Note
`FatSetFatRun`	`code change`	code (bounds the FAT-page pin count into the fixed stack array, CFR-gated)	Pins the FAT pages a run spans into on-stack array local_468 (~0x42 slots) and loops uVar5 = iVar4 + 1 times writing local_468[i2]/[i2+1]. Post (Feature_3174802747): if (0x41 < uVar5) { *(param_1+0x48) = 0xC0000102; ExRaiseStatus(); } before memset(local_468, ...) and the pin loop. Pre: the page count was unbounded, so a run spanning > 65 FAT pages overran the stack array.
`Feature_3174802747`	`gate`	added (CFR gate)	CFR flag gating the new page-count bound in FatSetFatRun; the original unbounded pin loop ships when disabled.

View full diff report View RCA report

Attack Path

A FAT run spanning too many FAT pages overruns a fixed-size on-stack pin array in the kernel

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

R4nger with Kunlun Lab & Zhiniang Peng with HUST
Jmini
boolgombear
transhoha

References

MSRC Advisory MITRE NVD