MS14-063 A Potential XP Exploit

Summary: Cisco Talos researchers Marcin Noga, Earl Carter and Martin Lee showed that MS14-063, a privilege escalation flaw in the Windows FASTFAT driver (CVE-2014-4115), can be triggered on Windows XP SP3 by inserting a USB stick with a malformed FAT32 partition. The bug is a pool overflow: when the number of FATs exceeds 2, the driver allocates pool based on the FAT count without accounting for the 24-byte structure element written in the fillArrayLoop, and the researchers note the flaw is hard to exploit because only limited data at particular offsets is controllable.
Why it matters: Windows XP is past end of life, so this vulnerability will never be patched, and the researchers' most lucrative attack scenario is a malformed partition that does not crash on insertion and carries an executable the victim runs, which then sprays the kernel pool and writes to the partition to trigger the bug in FatCommonWrite.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-4115
Related: Microsoft Update Tuesday October 2014: Fixes for 4 0-day Vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026