CVE-2026-6684: FatFS GPT Partition-Scan DoS Vulnerability

FatFS GPT partition-scan loop DoS (pre-R0.16) Vulnerability Overview CVE ID: CVE-2026-6684 CVSS Score: 3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium) Impact: Partial Description: This vulnerability affects versions of ChaN's FatFS prior to R0.16, which performs GPT scanning with . The issue stems from an unbounded loop count derived from the GPT header field , resulting in extremely long or infinite scan times during mount operations. Affected Scope Affected Product: FatFs Downstream Projects: - Rene Stange Circle - Adafruit Industries TinyUF2 (bundles an old snapshot) - Eugene Tarassov's Vivado RISC-V - Other pre-R0.16 integrations with LBA64 enabled Technical Details Vulnerability Cause: In vulnerable versions, GPT partition scanning trusts the partition entry count from the disk without applying a hard limit. Code Example: Exploitation Method: A crafted GPT image with forces extensive read loops until an error occurs, hanging the mount operation and frequently blocking boot or service startup. On unattended targets, this can serve as a persistent boot denial condition. Remediation Fixed Version: FatFS R0.16 introduced a check (including partition count and CRC validation) to constrain this behavior. Note: Legacy vendor trees remain exposed. Timeline 2026-03-17 (Tue): Initial discovery and documentation 2026-04-20 (Mon): CVE ID reserved 2026-04-20 (Mon): First contact with provider; no response from ChaN 2026-04-27 (Mon): Coordination assistance requested from JPCERT/CC 2026-04-28 (Tue): JPCERT/CC contacted the provider (no response after three attempts) 2026-05-14 (Wed): Contacted major downstream implementers based on JPCERT/CC recommendation (responded but unwilling to provide details) 2026-06-18 (Thu): Updated JPCERT/CC and downstream vendors; disclosure date changed to July 1 2026-07-01 (Wed): Public disclosure of CVE-2026-6684 Credits Discoverer: Tod Beardsley CVE Coordination: Tod Beardsley, discovered by runZero, Inc.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-6684: FatFS GPT Partition-Scan DoS Vulnerability