CVE-2026-6686 Details
Description
FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
A vulnerability exists in ChaN's FatFs library, specifically in versions R0.16 and earlier, where uninitialized cluster data can be exposed. This occurs when the function 'f_lseek()' extends files beyond the end of the file (EOF) without properly zero-filling the newly allocated clusters. As a result, stale data from previously deleted files can be read, potentially revealing sensitive information such as old firmware images, private keys, or other confidential data. This issue is particularly concerning in environments that share an SD card between a bootloader and an application, or in over-the-air (OTA) update processes that use FAT-formatted media.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | CISA-ADP | Third Party AdvisoryExploit |
| https://elm-chan.org/fsw/ff/ | runZero | Product |
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | runZero | Third Party AdvisoryExploit |
| https://www.runzero.com/advisories/fatfs-uninit-cluster-exposure-cve-2026-6686/ | runZero | Third Party Advisory |
| https://www.runzero.com/blog/fatfs-bugs/ | runZero | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | runZero |
Affected Products
| Product | Versions |
|---|---|
| elm-chan fatfs | <= r0.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | runZero |