CVE-2026-93689

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93689
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93689.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93689
Published
2026-09-18T15:06:04Z
Modified
2026-09-24T08:22:23Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/O
Details

WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system crash.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93689.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "last_affected":  "2.2.26215"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "fixed":  "2.2.26215"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/winfsp/winfsp

Affected ranges

Type
GIT
Repo
https://github.com/winfsp/winfsp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b8103265ec63fa87ac264c62bb796dbc38376652
Fixed
fde790d8ea41283606d1c56b557608a17e455f59
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

Other
GPLv3
before-rebrand-support
v0.*
v0.10
v0.11
v0.12
v0.13
v0.14
v0.16
v0.17
v0.9
v1.*
v1.0
v1.0RC1
v1.0RC2
v1.0RC3
v1.1
v1.1.17192
v1.10
v1.10B1
v1.10B2
v1.10B3
v1.10B4
v1.10B5
v1.11
v1.11B1
v1.11B2
v1.11B3
v1.11RC1
v1.1B1
v1.1B2
v1.1B3
v1.2
v1.2B1
v1.2B2
v1.2B3
v1.3B1
v1.3B2
v1.3B3
v1.4B1
v1.4B2
v1.4B3
v1.5
v1.5B1
v1.5B2
v1.5B3
v1.5B4
v1.5B5
v1.6
v1.7
v1.7B1
v1.7B2
v1.8B1
v1.8B2
v1.8B3
v1.9
v1.9B1
v1.9B2
v2.*
v2.0
v2.0B1
v2.0B2
v2.0RC1
v2.1
v2.1B1
v2.1B2
v2.2B1
v2.2B2
v2.2B3
v2.2B4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93689.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "310144547497755340342771537126062955353",
                "282066152080186285032257451810471237714",
                "53418514655879279331891009504780534234",
                "281403502953302829344506469835815627295"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-93689-1f747092",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/winfsp/winfsp/commit/b8103265ec63fa87ac264c62bb796dbc38376652",
        "target":  {
            "file":  "src/sys/devctl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "141545644312169895745879558420568320476",
            "length":  1456
        },
        "id":  "CVE-2026-93689-77c30428",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/winfsp/winfsp/commit/b8103265ec63fa87ac264c62bb796dbc38376652",
        "target":  {
            "file":  "src/sys/devctl.c",
            "function":  "FspFastIoDeviceControl"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:22:23Z"