Integer Overflow Vulnerability in FatFS FAT32 by Elm-chan
CVE-2026-6682

7.6HIGH

Key Information:

Vendor

Chan

Status
Fatfs
Vendor
CVE Published:
1 July 2026

What is CVE-2026-6682?

FatFS versions R0.16 and earlier are susceptible to an integer overflow vulnerability in the mount_volume() function. This flaw allows an attacker to manipulate file-size metadata, resulting in unsafe read lengths during processing by downstream components. The defect stems from improper handling of the multiplication operation involving fasize and fs->n_fats, causing potential security risks. Exploitation can potentially occur through remote channels, particularly in scenarios involving over-the-air (OTA) updates and other automated update pipelines.

Affected Version(s)

FatFs 0

References

https://www.runzero.com/blog/fatfs-bugs/
third-party-advisory
https://github.com/runZeroInc/vulns-2026-fatfs-chance
technical-description
https://elm-chan.org/fsw/ff/
product

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HD Moore of runZero, Inc.
Tod Beardsley of runZero, Inc.
.