CVE-2026-6684 Details
Description
FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
A denial-of-service vulnerability has been identified in ChaN's FatFs file system library, prior to version R0.16, when using GPT partition scanning with the 'FF_LBA64' option enabled. The vulnerability arises from an unbounded loop that iterates based on a crafted GPT header field, leading to extremely long or effectively infinite mount-time scans. This issue can cause devices to become non-functional, especially in bootloader contexts without a watchdog timer.
Users are advised to update to FatFs version R0.16 or later, which includes the necessary GPT header validation to prevent this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | CISA-ADP | Third Party AdvisoryExploit |
| https://elm-chan.org/fsw/ff/ | runZero | Product |
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | runZero | Third Party AdvisoryExploit |
| https://www.runzero.com/advisories/fatfs-gpt-scan-loop-dos-cve-2026-6684/ | runZero | Third Party Advisory |
| https://www.runzero.com/blog/fatfs-bugs/ | runZero | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | runZero |
Affected Products
| Product | Versions |
|---|---|
| elm-chan fatfs | < r0.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | runZero |