FatFs vulnerabilities

3 known vulnerabilities in FatFs from ChaN. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  FatFs: Buffer Copy without Checking Size of Input

  CVE-2026-6688Jul 1, 2026ChaN

  FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overf

• 7.6 High severity

  FatFs: Stack-based Buffer Overflow

  CVE-2026-6687Jul 1, 2026ChaN

  FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N

• 7.6 High severity

  FatFs: Integer Overflow or Wraparound

  CVE-2026-6682Jul 1, 2026ChaN

  In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or W