Loading vulnerability…
Remote Code Execution in Windows Fast FAT File System Driver
CVE-2025-24985 is a remote code execution vulnerability in the Windows Fast FAT File System Driver caused by an integer overflow or wraparound condition. Available reporting also associates the flaw with heap memory corruption during processing of a specially crafted virtual hard disk image using the Fast FAT file system path. By inducing the vulnerable driver to parse malicious filesystem metadata, an attacker can trigger memory corruption in kernel-context file system handling, creating a path to code execution on the target system. Microsoft reported that the vulnerability was being exploited in the wild at the time of disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution on the affected Windows system. Because the flaw is in a Windows file system driver, exploitation is expected to occur in a highly privileged kernel-context component, which can enable full compromise of the host, including installation of malware, tampering with data, disabling security controls, and establishment of persistence.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by restricting or monitoring the mounting of untrusted VHD files and other attacker-supplied disk images, limiting user ability to attach virtual storage where operationally feasible, and enforcing controls that prevent delivery and execution of untrusted containerized media. Additional defensive measures include application control, least-privilege administration, and heightened detection for suspicious virtual disk mounting activity.
Patch, then assume compromise.
Apply the Microsoft March 2025 security updates for affected Windows versions. Priority should be given to systems that permit users to mount removable or virtual disk images, especially where untrusted VHD content may be introduced. Standard patch validation should confirm that the updated Fast FAT driver is deployed across all affected client and server assets.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.