7.6

CVE-2026-6688

Medienbericht
Exploit

FatFs Buffer Overflow via Unbounded LFN Filename Copy

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elm-chan ≫ Fatfs Version <= r0.16
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.35
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
44488dab-36db-4358-99f9-bc116477f914 7.6 0.9 6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
06.07.2026 15:32
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
03.07.2026 23:46
https://www.runzero.com/blog/fatfs-bugs/
Third Party Advisory
Exploit
https://github.com/runZeroInc/vulns-2026-fatfs-chance
Third Party Advisory
Exploit
https://elm-chan.org/fsw/ff/
Product
https://www.runzero.com/advisories/fatfs-long-fn-of-downstream-cve-2026-6688/
Third Party Advisory