WinFsp versions through 2.2.26215 have a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler. This flaw occurs because the volume context is not validated before use. An unprivileged local user can exploit this to cause a denial of service by opening the WinFsp control device and issuing specific requests, resulting in a system crash.