# CVE-2026-68878 — Windows Fast FAT Driver `fastfat.sys` FAT-Run Page-Pin Stack Buffer Overflow (Local EoP to SYSTEM)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `fastfat.sys` (Fast FAT File System Driver) |
| **CVE ID** | CVE-2026-68878 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 8.0 / 7.0 — `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-121: Stack-based Buffer Overflow |
| **Delivery** | Network + user interaction — victim writes to an attacker-supplied FAT volume |
| **KB / Fixed build** | KB5124008 — `fastfat.sys` 10.0.26100.9444 (Win11 24H2/25H2 x64) |
| **Patch Date** | September 8, 2026 (2026-Sep) |
| **Pre-patch binary** | `fastfat.sys` 10.0.26100.9278 — SHA256 `0da9ccf1c8eb4f04df19fde152aae75a255aa1aa09b055d70bcc32010c563d13` |
| **Post-patch binary** | `fastfat.sys` 10.0.26100.9444 — SHA256 `5605ccbefd5c7d3e04853c174db27b368b40228f85d2481f8bf3f0b499a91527` |
| **Feature flag** | `Feature_3174802747` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> This is the **stack / EoP** half of the September `fastfat` pair. The sibling **heap** overflow is
> **CVE-2026-69347** (`FatSetupAllocationSupport`, `Feature_4205292859`). The same build also hardens an
> unrelated EFS FSCTL path (`Feature_709593401` / `Feature_591104313`), not attributed to this CVE.

---

## Product Description

`fastfat.sys` maintains FAT allocation state. `FatSetFatRun` writes a run of FAT entries by **pinning the
FAT pages the run spans** into a **fixed-size on-stack array** (`local_468`, room for ~`0x42` = 66
pinned-page slots) and iterating over them.

---

## Vulnerability Summary

The number of FAT pages a run spans is derived from its start/length:
`iVar4 = (end >> 0xC) − (start >> 0xC)`, and the pin loop runs `uVar5 = iVar4 + 1` times, each writing
`local_468[i*2]` and `local_468[i*2+1]`. Pre-patch `uVar5` was **not bounded**, so a crafted FAT volume /
file layout that makes a run span **more than 65 4 KB FAT pages** drives the loop past the end of the
on-stack `local_468` array — a **stack buffer overflow** in kernel context, i.e. a SYSTEM-elevation
primitive. Microsoft rates it **Important, 8.0** (`AV:N`, `PR:L`, `UI:R` — the victim interacts with an
attacker-supplied volume).

---

## Prerequisites and Constraints

- The victim writes to / updates allocation on an attacker-influenced FAT volume (`AV:N`, `PR:L`, `UI:R`).
- The FAT run is crafted to span more than 65 FAT pages so the pin count exceeds `local_468`'s capacity.

---

## Vulnerability Details

### Root Cause

`FatSetFatRun` sized its page-pin loop from attacker-influenced run geometry without checking it against
the fixed capacity of the on-stack `local_468` array.

### The patch (confirmed — diff, .9278 → .9444)

Gated behind `Feature_3174802747`, `FatSetFatRun` computes the page count and **bounds it before the loop**:

```c
// FatSetFatRun (.9444) — PATCHED (from the diff, Feature_3174802747)
uVar3 = uVar6 + (param_4 - 1) * 2;
iVar4 = (uVar3 >> 0xc) - (uVar6 >> 0xc);
uVar5 = iVar4 + 1;                                   // number of FAT pages the run spans
if (Feature_3174802747__IsEnabled() && (0x41 < uVar5)) {   // *** > 65 pages ***
    *(undefined4 *)(param_1 + 0x48) = 0xC0000102;    // STATUS_FILE_CORRUPT_ERROR
    ExRaiseStatus();                                 // bail out — does not return
}
memset(local_468, 0, (ulonglong)(iVar4 + 2) << 4);
for (uVar14 = 0; uVar14 < uVar5; uVar14 = uVar14 + 1)
    FatPrepareWriteVolumeFile(param_1, ..., local_468 + uVar14*2, local_468 + uVar14*2 + 1, 1);
```

With the `0x41 < uVar5` cap raising `STATUS_FILE_CORRUPT_ERROR`, a run can no longer drive the pin loop
past the fixed 66-slot on-stack array.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3174802747`.** The bound runs only when the flag is enabled; the original
unbounded loop ships when disabled. Verify the flag is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Kernel-stack bug-checks in `fastfat!FatSetFatRun` / `FatPrepareWriteVolumeFile` while
writing to removable or remote FAT volumes; `STATUS_FILE_CORRUPT_ERROR` on write to crafted volumes on
patched builds is the fix firing. Restrict writing to untrusted FAT media.

**Config.** The fix is CFR-gated — confirm `Feature_3174802747` is enabled and the Sep-2026 update
(`fastfat.sys` 10.0.26100.9444, KB5124008) is installed.

---

## References

- MSRC advisory — CVE-2026-68878 (Windows Fast FAT Driver Elevation of Privilege), 2026-09-08, KB5124008.
- Sibling: CVE-2026-69347 (Fast FAT heap overflow, `FatSetupAllocationSupport`).
- Full binary diff: `/data/patch_diffs/fastfat_sys-cve-2026-68878-ghidriff.md`