CVE-2026-93689: Winfsp

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system crash.

Affected products

• Winfsp Winfsp: up to and including 2.2.26215

Published 2026-09-18. Last modified 2026-09-22.