Executive brief
FatFs is a widely used file system module for small embedded systems, such as those found in industrial controllers, medical devices, and consumer electronics. A security flaw allows sensitive data from previously deleted files to be exposed when a new file is created or extended. An attacker with physical access to the device's storage could potentially recover old encryption keys, logs, or firmware fragments that were supposed to be erased.
Technical details
A 'Use of Uninitialized Resource' (CWE-908) vulnerability exists in the f_lseek() function of FatFs R0.16 and earlier. When f_lseek() is used to extend a file beyond the current End-of-File (EOF), the library updates the logical file size and allocates new clusters but fails to initialize these clusters with zeroes. Consequently, if the newly allocated sectors previously contained data from deleted files, that stale content becomes readable through the extended file region. This enables information disclosure of sensitive remnants like firmware chunks or keys on shared media. The vulnerability requires physical access to the storage media or a local interface capable of triggering file seeks and subsequent reads.
Affected products
- ChaN FatFs R0.16 and earlier
Timeline
- 2026-07-01: advisory: NVD publication date
- 2026-06-30: disclosed: runZero advisory update date