Stack Overflow Vulnerability in FatFs by Elm-Chan
CVE-2026-6687

7.6HIGH

Key Information:

Vendor

Chan

Status
Fatfs
Vendor
CVE Published:
1 July 2026

What is CVE-2026-6687?

FatFs versions R0.16 and earlier are susceptible to a stack overflow vulnerability in the f_getlabel() function. This issue arises because the length of the exFAT label (XDIR_NumLabel) is inadequately validated, allowing for excessive data to be processed beyond predetermined specifications. Attackers exploiting this vulnerability could potentially cause a denial of service or execute arbitrary code, compromising the integrity and availability of systems reliant on affected FatFs libraries.

Affected Version(s)

FatFs 0

References

https://www.runzero.com/blog/fatfs-bugs/
third-party-advisory
https://github.com/runZeroInc/vulns-2026-fatfs-chance
technical-description
https://elm-chan.org/fsw/ff/
product

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HD Moore of runZero, Inc.
Tod Beardsley of runZero, Inc.
.