Executive brief
FatFs is a widely used open-source software library that allows embedded devices, such as IoT sensors and industrial controllers, to read and write data on SD cards and USB drives. A vulnerability in how the library handles FAT32 file systems allows an attacker to provide a specially crafted storage device or update file that triggers memory corruption. This can lead to a complete system takeover, data theft, or permanent device failure, impacting a vast range of consumer and industrial electronics.
Technical details
An integer overflow (CWE-190) exists in the mount_volume() function of FatFs when processing FAT32 volumes. Specifically, the multiplication of the FAT size (fasize) by the number of FATs (fs->n_fats) can wrap around on 32-bit systems if provided with crafted values in the BIOS Parameter Block (BPB). This overflow causes the library to miscalculate the location of the data area (fs->database), allowing an attacker to forge file metadata returned by functions like f_stat() and f_readdir(). Downstream applications that rely on the resulting finfo.fsize to allocate buffers or limit f_read() operations become vulnerable to heap or stack-based buffer overflows. While the primary attack vector is physical (malicious SD card), the vulnerability can also be triggered via network-delivered OTA update containers if they are mounted before full cryptographic verification.
Affected products
- ChaN FatFs R0.16 and earlier
Timeline
- 2026-06-30: advisory: Initial advisory published by runZero
- 2026-07-01: disclosed: CVE-2026-6682 published to NVD