# CVE-2025-21180 — Windows exFAT File System `exfat.sys` Allocation-Support Size Integer Overflow → Heap Buffer Overflow (Mount-Time RCE)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `exfat.sys` (Windows exFAT File System driver) |
| **CVE ID** | CVE-2025-21180 |
| **Impact** | Remote Code Execution (local; "Remote" = attacker location — arbitrary code execution) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122: Heap-based Buffer Overflow (via integer overflow) |
| **Delivery** | Local — user mounts a specially crafted exFAT volume (VHD) |
| **KB / Fixed build** | KB5053598 — `exfat.sys` 10.0.26100.3470 (Win11 24H2 x64) |
| **Patch Date** | March 11, 2025 (2025-Mar) |
| **Pre-patch binary** | `exfat.sys` 10.0.26100.2454 — SHA256 `8a6a3fe8720003c9489a5baacb6d2a64e2a1bbbbbfe7187face4a44d80a6c786` |
| **Post-patch binary** | `exfat.sys` 10.0.26100.3470 — SHA256 `841c4900a603398f6dcf6f6dd394a3183182a394c2fc00f1a241e2b70140df09` |
| **Feature flag** | `Feature_930095419` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation More Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`exfat.sys` is the Windows **exFAT file-system driver**. When an exFAT volume is
mounted, `FppSetupAllocationSupport` derives the parameters of the volume's
**allocation-bitmap support** from on-disk metadata (the exFAT boot region:
BytesPerSectorShift, SectorsPerClusterShift, cluster count, and related length
fields) and sizes the in-memory structures used to track cluster allocation.

---

## Vulnerability Summary

`FppSetupAllocationSupport` takes a 32-bit count/length derived from the (untrusted)
exFAT volume (`param_2 + 0x138`, set from an on-disk field) and rounds it up to a
granularity boundary by adding `0xffff`. Pre-patch, this `count + 0xffff` was computed
**without an overflow check**, so a crafted volume supplying a value near `0xFFFFFFFF`
would **wrap the 32-bit addition to a small number** (CWE-190), producing an
**undersized heap allocation** for the allocation-support structures. Subsequent
population of those structures then writes past the short buffer — a **heap-based
buffer overflow (CWE-122)**. Because exFAT parses the volume at **mount time**, an
attacker who convinces a local user to mount a malicious VHD (`AV:L`, `UI:R`) can
trigger the overflow and achieve arbitrary code execution in the kernel.

---

## Prerequisites and Constraints

- Local; no privileges (`PR:N`) but **user interaction** (`UI:R`): the victim mounts a
  specially crafted exFAT volume / VHD.
- The crafted volume supplies an allocation count/length near `UINT_MAX` so the
  `+ 0xffff` rounding overflows.
- Result: an undersized allocation is made and then overrun → heap overflow at mount.

---

## Vulnerability Details

### Root Cause

The allocation-support size was rounded up with `count + 0xffff` using 32-bit
arithmetic on a volume-controlled count, with no check that the addition did not wrap.
A near-`UINT_MAX` count wrapped to a tiny size, so the allocation was too small for the
data later written into it.

### The patch (confirmed — diff, .2454 → .3470)

The diff shows `FppSetupAllocationSupport` gaining an explicit **overflow guard**
(gated behind `Feature_930095419`) that aborts the mount when the `+ 0xffff` rounding
would wrap:

```c
// FppSetupAllocationSupport (10.0.26100.3470) — PATCHED (from the diff)
uVar7 = *(uint *)(param_2 + 0x138);                 // 32-bit count/length from the volume
if (Feature_930095419__private_IsEnabled()
        && (uVar7 + 0xffff < uVar7)) {              // *** unsigned overflow check on the rounding ***
    *(int *)(param_1 + 0x48) = 0xc0000102;          // STATUS_FILE_CORRUPT_ERROR
    ExRaiseStatus();                                // abort the mount (does not return)
}
```

`uVar7 + 0xffff < uVar7` is true only when adding `0xffff` wraps the 32-bit value —
exactly the condition that previously produced the undersized allocation. On that
path the driver now records `STATUS_FILE_CORRUPT_ERROR` and raises, rejecting the
malformed volume before any undersized buffer is allocated or written, closing the
integer-overflow-to-heap-overflow.

### Patch Completeness Assessment

**CFR-gated behind `Feature_930095419`.** The overflow guard runs only when the flag
is enabled; the original unchecked rounding still ships when disabled. Verify
`Feature_930095419` is enabled to confirm the fix is live. (The diff is a wide
`.2454 → .3470` span that also linked in the CFR feature-usage instrumentation; the
security-relevant code change is the overflow guard above.)

---

## Detection Guidance

**Behavioural.** Pool corruption / bugcheck crashes in `exfat!FppSetupAllocationSupport`
(and exFAT mount paths) when mounting removable media or VHDs on unpatched/flag-disabled
builds. Treat mounting of untrusted exFAT volumes / VHDs as a risk; restrict auto-mount
of attacker-supplied disk images.

**Config.** The fix is CFR-gated — confirm `Feature_930095419` is enabled.

---

## References

- MSRC advisory — CVE-2025-21180 (Windows exFAT File System Remote Code Execution), released 2025-03-11, KB5053598.
- Full binary diff: `/data/patch_diffs/exfat_sys-cve-2025-21180-ghidriff.md`