CVE-2026-93689 — WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/O
WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context befor…
Published: 2026-09-18 · CVSS: 6.8 · CVSS 4.0
WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system crash.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7