Vendor
3 published CVES affecting WinFsp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device...
Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.
Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to the affected software.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.