7.6

CVE-2026-6682

Medienbericht
Exploit

FatFs Integer Overflow in FAT32 Volume Mount

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elm-chan ≫ Fatfs Version <= r0.16
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.35
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
44488dab-36db-4358-99f9-bc116477f914 7.6 0.9 6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
06.07.2026 15:32
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
03.07.2026 23:46
https://www.runzero.com/blog/fatfs-bugs/
Third Party Advisory
Exploit
https://github.com/runZeroInc/vulns-2026-fatfs-chance
Third Party Advisory
Exploit
https://elm-chan.org/fsw/ff/
Product
https://www.runzero.com/advisories/fatfs-fat32-int-of-mnt-cve-2026-6682/
Third Party Advisory
Exploit