# CVE-2026-69347 — Windows Fast FAT Driver `fastfat.sys` BPB Size Integer Overflow → Heap Buffer Overflow (Malicious-Volume RCE)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `fastfat.sys` (Fast FAT File System Driver) |
| **CVE ID** | CVE-2026-69347 |
| **Impact** | Remote Code Execution (local — code execution from a crafted FAT volume) |
| **MSRC severity** | Important |
| **CVSS** | 7.4 / 6.4 — `CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122: Heap-based Buffer Overflow (via integer overflow) |
| **Delivery** | Local — victim mounts/accesses an attacker-crafted FAT volume |
| **KB / Fixed build** | KB5124008 — `fastfat.sys` 10.0.26100.9444 (Win11 24H2/25H2 x64) |
| **Patch Date** | September 8, 2026 (2026-Sep) |
| **Pre-patch binary** | `fastfat.sys` 10.0.26100.9278 — SHA256 `0da9ccf1c8eb4f04df19fde152aae75a255aa1aa09b055d70bcc32010c563d13` |
| **Post-patch binary** | `fastfat.sys` 10.0.26100.9444 — SHA256 `5605ccbefd5c7d3e04853c174db27b368b40228f85d2481f8bf3f0b499a91527` |
| **Feature flag** | `Feature_4205292859` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

> This is the **heap / RCE** half of the September `fastfat` pair. The sibling **stack** overflow is
> **CVE-2026-68878** (`FatSetFatRun`, `Feature_3174802747`). The same build also hardens an unrelated EFS
> FSCTL path (`Feature_709593401` / `Feature_591104313`), not attributed to this CVE.

---

## Product Description

`fastfat.sys` is the Windows FAT/FAT32/exFAT-adjacent file-system driver. When a FAT volume is mounted,
`FatSetupAllocationSupport` reads the volume's BIOS Parameter Block (BPB) and computes the size and layout
of the FAT and allocation area, which then drive buffer allocation and indexing for the volume.

---

## Vulnerability Summary

`FatSetupAllocationSupport` derives the FAT/allocation size from BPB fields — bytes-per-sector (`+0x120`),
reserved (`+0x124`), number-of-FATs (`+0x126`), sectors-per-FAT (`+0x128`), directory/root entries
(`+0x12a`/`+0x12e`) and total sectors (`+0x138`/`+0x13c`) — and stores results at `+0x158`/`+0x160`/`+0x168`.
Pre-patch several of these products were computed in **32-bit without overflow checks**, so a crafted FAT
volume with hostile BPB values wraps the computed size to a small value while the driver later processes
the true (large) amount — a **heap buffer overflow**, reachable just by mounting/accessing the volume
(`PR:N`). Microsoft rates it **Important, 7.4** and titles it RCE.

---

## Prerequisites and Constraints

- Local access sufficient to get the volume mounted/parsed (`AV:L`, `PR:N`, `UI:N`); `AC:H` reflects the
  heap-grooming/precision needed to turn the overflow into control.
- The BPB is crafted so a size product overflows 32-bit arithmetic.

---

## Vulnerability Details

### Root Cause

The FAT/allocation size products were evaluated in 32-bit and used to size/index heap buffers without
verifying they had not overflowed, so a hostile BPB produced an undersized allocation.

### The patch (confirmed — diff, .9278 → .9444)

Gated behind `Feature_4205292859`, `FatSetupAllocationSupport` adds explicit **integer-overflow guards**
on each size product before the value is used:

```c
// FatSetupAllocationSupport (.9444) — PATCHED (from the diff, Feature_4205292859)
uVar17 = (ulonglong)bytes_per_sector * (ulonglong)total_sectors;
if (0xffffffff < uVar17) goto LAB_0;                 // reject 32-bit overflow
if (Feature_4205292859__IsEnabled()) {
    uVar17 = (ulonglong)num_fats * (uVar17 & 0xffffffff);
    if (0xffffffff < uVar17 ||
        (uVar15 = reserved * bytes_per_sector, uVar15 + (int)uVar17 < uVar15))  // additive wrap
        goto LAB_0;
    ...
}
```

Each `x * y` and `a + b` that feeds `+0x158`/`+0x160`/`+0x168` is now checked for 32-bit overflow / additive
wrap and, on failure, jumps to the error path (`LAB_0`) before sizing any allocation — so an overflowing
BPB can no longer produce an undersized heap buffer.

### Patch Completeness Assessment

**CFR-gated behind `Feature_4205292859`.** The overflow guards run only when the flag is enabled; the
original unchecked computation ships when disabled. Verify the flag is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Pool corruption / bug-checks in `fastfat!FatSetupAllocationSupport` when mounting
removable or file-backed FAT volumes; auto-mount of untrusted USB/VHD/ISO FAT images. Restrict mounting of
untrusted volumes.

**Config.** The fix is CFR-gated — confirm `Feature_4205292859` is enabled and the Sep-2026 update
(`fastfat.sys` 10.0.26100.9444, KB5124008) is installed.

---

## References

- MSRC advisory — CVE-2026-69347 (Windows Fast FAT Driver Remote Code Execution), 2026-09-08, KB5124008.
- Sibling: CVE-2026-68878 (Fast FAT stack overflow, `FatSetFatRun`).
- Full binary diff: `/data/patch_diffs/fastfat_sys-cve-2026-69347-ghidriff.md`