CVE-2026-93689: falha de média gravidade em winfsp
WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/O
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system crash.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
winfsp · winfspReferências
https://github.com/winfsp/winfsphttps://github.com/winfsp/winfsp/blob/v2.2B4/src/sys/devctl.c#L105-L114https://github.com/winfsp/winfsp/blob/v2.2B4/src/sys/devctl.c#L146-L152https://github.com/winfsp/winfsp/blob/v2.2B4/src/sys/devctl.c#L68-L73https://github.com/winfsp/winfsp/blob/v2.2B4/src/sys/volume.c#L1059-L1060https://github.com/winfsp/winfsp/commit/b8103265ec63fa87ac264c62bb796dbc38376652https://github.com/winfsp/winfsp/releases/tag/v2.2B4https://www.vulncheck.com/advisories/winfsp-through-2.2.26215-null-pointer-dereference-via-fast-i-o