A stack-based buffer overflow exists in the Windows Fast FAT driver that permits an authorized attacker to elevate their privileges over a network. The flaw allows the attacker to gain higher privilege levels on the host, potentially enabling full administrative control. The vulnerability is specifically a stack corruption flaw as identified by CWE‑121.

The vulnerability impacts Microsoft Windows Windows 10 from version 1607 through 22H2, Windows 11 from version 23H2 up to 26H1, and Windows Server releases from 2012 through 2025, including Server Core installations. Users of any of these operating system editions are at risk if the Fast FAT driver is enabled.

The CVSS score of 8 indicates high severity and the lack of an EPSS rating suggests exploit probability is unquantified but could be significant in environments where the driver is active. The flaw requires the attacker to be authenticated over the network – an authorized user or compromised account – to trigger the overrun. There are no known public exploits listed in the CISA KEV catalog, so the risk is primarily from internal threat actors or attackers who have gained local access.