Security firm runZero has disclosed seven vulnerabilities in FatFs, a lightweight filesystem library that handles FAT and exFAT formats on USB drives and SD cards. The flaws matter because FatFs is everywhere. It ships in security cameras, drones, industrial controllers, hardware crypto wallets, and other embedded devices.
The worst-case scenario? An attacker gets physical access with a booby-trapped USB drive or SD card. On many embedded systems, that’s all they need. “Any physical access leads to a jailbreak,” runZero warns.
All seven bugs work the same way. The device tries to read a deliberately malformed storage volume or firmware image, and FatFs mishandles the bad data. The ratings range from Medium to High, with no Criticals.
The headline bug is CVE-2026-6682 (CVSS 7.6), an integer overflow in the FAT32 mount code that can lead to memory corruption and code execution. Also at 7.6: CVE-2026-6687, where an exFAT volume-label field overflows a small buffer, and CVE-2026-6688, where long filenames overflow wrapper code many projects put around FatFs.
Lower-severity bugs include a cache math wrap that silently corrupts data, an exFAT divide-by-zero that can brick hardware, a file extension that leaks deleted data, and a malformed GPT partition table that hangs the device during mount.
The hard part: FatFs is maintained by one person. runZero says it tried repeatedly to reach the maintainer and looped in Japan’s JPCERT/CC. No response. There’s no upstream fix for the memory-corruption bugs, no security mailing list, and no way for downstream vendors to know they’re affected.
Affected platforms include Espressif ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and the SWUpdate updater. runZero shipped proof-of-concept disk images and a working exploit in a companion repository.
If you build firmware that touches FAT or exFAT, audit your FatFs copy and the wrapper code around it. If you run affected devices, treat physical ports and update channels as attack surface. Watch for vendor firmware updates — but don’t hold your breath. This one’s going to take years to fully fix.
References
- CVE-2026-6682 — FatFs FAT32 mount integer overflow (CVSS 7.6)
- CVE-2026-6687 — FatFs exFAT volume-label buffer overflow (CVSS 7.6)
- CVE-2026-6688 — FatFs long filename overflow in wrapper code (CVSS 7.6)
- CVE-2026-6685 — FatFs cache math wrap data corruption (CVSS 6.1)
- CVE-2026-6683 — FatFs exFAT divide-by-zero (CVSS 4.6)
- CVE-2026-6686 — FatFs file extension data leak (CVSS 4.6)
- CVE-2026-6684 — FatFs malformed GPT partition table hang (CVSS 4.6)
- runZero: FatFs Vulnerability Disclosure
