Is CVE-2026-6682 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6682 being exploited in the wild.

How severe is CVE-2026-6682?

High severity, with a CVSS score of 7.6, published 1 July 2026.

Is there a fix for CVE-2026-6682?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6682 attacked?

It is attacked with physical access or over the network, in a software library.

Am I affected by CVE-2026-6682?

Check whether you run ChaN FatFs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6682: ChaN FatFs integer overflow in mount_volume

CVE-2026-6682 · Severity: high · CVSS 7.6 · Published 2026-07-01

FatFs is a widely used open-source software library that allows embedded devices, such as IoT sensors and industrial controllers, to read and write data on SD cards and USB drives. A vulnerability in how the library handles FAT32 file systems allows an attacker to provide a specially crafted storage device or update file that triggers memory corruption. This can lead to a complete system takeover, data theft, or permanent device failure, impacting a vast range of consumer and industrial electronics.

Technologies: ChaN FatFs. Vendors: ChaN.

Quick answers

Is CVE-2026-6682 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6682 being exploited in the wild.
How severe is CVE-2026-6682?: High severity, with a CVSS score of 7.6, published 1 July 2026.
Which products and versions are affected?: ChaN FatFs R0.16 and earlier.
Is there a fix for CVE-2026-6682?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6682 attacked?: It is attacked with physical access or over the network, in a software library.
Am I affected by CVE-2026-6682?: Check whether you run ChaN FatFs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow (CWE-190) exists in the mount_volume() function of FatFs when processing FAT32 volumes. Specifically, the multiplication of the FAT size (fasize) by the number of FATs (fs->n_fats) can wrap around on 32-bit systems if provided with crafted values in the BIOS Parameter Block (BPB). This overflow causes the library to miscalculate the location of the data area (fs->database), allowing an attacker to forge file metadata returned by functions like f_stat() and f_readdir(). Downstream applications that rely on the resulting finfo.fsize to allocate buffers or limit f_read() operations become vulnerable to heap or stack-based buffer overflows. While the primary attack vector is physical (malicious SD card), the vulnerability can also be triggered via network-delivered OTA update containers if they are mounted before full cryptographic verification.

Affected products

ChaN FatFs R0.16 and earlier

Timeline

2026-06-30: advisory: Initial advisory published by runZero
2026-07-01: disclosed: CVE-2026-6682 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.