ChaN vulnerabilities
We track 3 vulnerabilities in ChaN products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest ChaN vulnerabilities
- 7.6 High severity
FatFs: Buffer Copy without Checking Size of Input
FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overf
- 7.6 High severity
FatFs: Stack-based Buffer Overflow
FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N
- 7.6 High severity
FatFs: Integer Overflow or Wraparound
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or W