CVE-2026-6682 Details
Description
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
A vulnerability exists in ChaN's FatFS library, specifically in versions through R0.16, due to an integer overflow in the FAT32 volume mounting process. The issue arises when the 'BPB_FATSz32' value is crafted to produce a large number, causing the multiplication with 'NumFATs' to overflow. This manipulation leads to attacker-controlled file size metadata, which can be exploited by downstream applications that read file sizes without proper validation. The vulnerability allows for unsafe read lengths, potentially leading to memory corruption and code execution on embedded devices. Additionally, this vulnerability can be exploited remotely through over-the-air update pipelines that use FAT-formatted images.
Users should update to FatFS version R0.16 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | CISA-ADP | Third Party AdvisoryExploit |
| https://elm-chan.org/fsw/ff/ | runZero | Product |
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | runZero | Third Party AdvisoryExploit |
| https://www.runzero.com/advisories/fatfs-fat32-int-of-mnt-cve-2026-6682/ | runZero | Third Party AdvisoryExploit |
| https://www.runzero.com/blog/fatfs-bugs/ | runZero | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | runZero |
Affected Products
| Product | Versions |
|---|---|
| elm-chan fatfs | <= r0.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | runZero |