Multiple FatFs Vulnerabilities Expose Millions of Embedded Devices to Cyber Risks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Security researchers at runZero have disclosed seven new CVEs affecting FatFs, the ubiquitous lightweight FAT\/exFAT filesystem driver used across embedded and IoT ecosystems.<\/p>\n
The vulnerabilities range from CVSS Medium to High, with no Critical-rated findings, but their reach is significant: FatFs underpins platforms including Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate, extending into consumer IoT, industrial controllers, drones, and crypto wallets.<\/p>\n
The research revisits a 2017 manual audit and fuzzing effort that surfaced only minor bugs. In March 2026, runZero reapproached the codebase using Visual Studio Code and GitHub Copilot<\/a> in \u201cauto\u201d mode, without custom harnesses or fuzzing loops.<\/p>\n The LLM-assisted approach uncovered previously overlooked bugs and helped validate real-world exploitability across multiple embedded scenarios, highlighting the growing role of AI in long-tail supply chain vulnerability<\/a> research.<\/p>\n CVE-2026-6682<\/strong> (CVSS 7.6, High) \u2014 Integer overflow in mount_volume() during FAT32 mounting produces attacker-controlled file-size metadata, potentially leading to heap or stack overflow and code execution.<\/p>\n CVE-2026-6687<\/strong> (CVSS 7.6, High) \u2014 An uncapped exFAT label-length field in f_getlabel() enables oversized writes into caller-provided stack buffers, creating a clean memory-corruption primitive.<\/p>\n CVE-2026-6688<\/strong> (CVSS 7.6, High) \u2014 When long filenames (LFN) are enabled, oversized fno.fname values overflow fixed-size buffers in downstream callers using FatFs Vulnerabilities<\/strong><\/h2>\n