CVE-2026-6685 Details

A vulnerability in ChaN's FatFs library, specifically in versions through R0.16, allows for stale data to be written into memory due to an integer underflow in the dirty-cache management. This issue arises during interleaved read and write operations on fragmented filesystems, where the sector mapping can cause a subtraction wrap, leading to out-of-bounds memory writes. The vulnerability is present in the 'f_read()' and 'f_write()' functions, where the cached sector can numerically precede the current read window, especially on long-lived devices where FAT allocation becomes non-monotonic over time. The vulnerability can be exploited by mounting a crafted FAT volume that exploits this arithmetic wrap, causing the library to write stale cached data far outside the intended buffer, potentially leading to silent data corruption or more severe memory corruption issues, such as a stack or heap overflow.