CVE-2026-6687— FatFs Stack Buffer Overflow via Uncapped exFAT Label Length
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6687
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FatFs Stack Buffer Overflow via Uncapped exFAT Label Length
Source: NVD (National Vulnerability Database)
Vulnerability Description
FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
栈缓冲区溢出
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-6687
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6687
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-6687 (1)
Security Blog Posts for CVE-2026-6687 (1)
Vendor Pages for CVE-2026-6687 (1)
Other References for CVE-2026-6687 (1)
Same Patch Batch · ChaN · 2026-07-01 · 7 CVEs total
| CVE-2026-6688 | 7.6 HIGH | FatFs Buffer Overflow via Unbounded LFN Filename Copy |
| CVE-2026-6682 | 7.6 HIGH | FatFs Integer Overflow in FAT32 Volume Mount |
| CVE-2026-6685 | 6.1 MEDIUM | FatFs Integer Underflow in Dirty-Sector Cache Flush |
| CVE-2026-6684 | 4.6 MEDIUM | FatFs Infinite Loop in GPT Partition Scan |
| CVE-2026-6686 | 4.6 MEDIUM | FatFs Use of Uninitialized Clusters After Seek Past EOF |
| CVE-2026-6683 | 4.6 MEDIUM | FatFs Divide-by-Zero in exFAT Sync |
IV. Related Vulnerabilities
Same product: FatFs
Same vendor: ChaN
Same weakness: CWE-121
- CVE-2026-54502
Oj: Stack Buffer Overflow in Oj.dump via Large Indent - CVE-2026-9105
Authenticated Stack-Based Buffer Overflow in TP-Link TL-WR84 - CVE-2026-13573
llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp inse - CVE-2026-11979
Stack-Based Buffer Overflow in libxml2 - CVE-2026-13564
Edimax EW-7478APC POST Request formPPPoESetup stack-based ov
V. Comments for CVE-2026-6687
No comments yet