CVE-2025-24985 PoC — Windows Fast FAT File System Driver Remote Code Execution Vulnerability

Description

Detection of malicious VHD files for CVE-2025-24985

Readme

# cve-2025-24985

Compute the number of cluster of a VHD file to detect overflow.

Supportted boot sectors:
- [x] MBR
- [x] GPT

## Usage

```sh
python -m cve_2025_24985 -f <path/to/file.vhd>
```

## Setup
### Nix

```sh
# With direnv:
direnv allow

# Or Without direnv:
nix develop
```

### Peotry

WIP

### Docker

WIP

## TODO:

- [x] Auto build libvhdi with poetry
- [ ] Setup poetry install
- [ ] Fix dockerfile with pyvhdi dependency

File Snapshot

Remarks