CVE-2026-6687 Details
Description
FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
A stack buffer overflow vulnerability has been identified in FatFs versions through R0.16. The issue arises in the function f_getlabel(), where the exFAT label length is accepted without proper validation, allowing for oversized writes into fixed-size buffers. This vulnerability, which maps to CWE-121, is particularly concerning in projects generated by STM32CubeMX, where the default label buffer size is insufficient to handle the maximum label length allowed by the exFAT specification.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | CISA-ADP | Third Party AdvisoryExploit |
| https://elm-chan.org/fsw/ff/ | runZero | Product |
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | runZero | Third Party AdvisoryExploit |
| https://www.runzero.com/advisories/fatfs-exfat-label-len-of-cve-2026-6687/ | runZero | Third Party Advisory |
| https://www.runzero.com/blog/fatfs-bugs/ | runZero | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | runZero |
Affected Products
| Product | Versions |
|---|---|
| elm-chan fatfs | <= r0.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | runZero |