CVE-2026-6682: FatFs Integer Overflow Leading to RCE in FAT32 Mount

Vulnerability Overview CVE-2026-6682 is a FAT32 integer overflow vulnerability occurring within the function. This vulnerability allows an attacker to cause memory corruption and potential code execution by constructing specific file metadata. Affected Scope Affected Products: ChaN's FatFs R0.16 and earlier versions. Downstream Projects: - Espressif IoT Development Framework - STMicroelectronics Middleware FatFS MCU - ArduPilot - RIOT OS - Arm Limited Mbed - YANSSIE HK LIMITED Keystone3 Firmware - Bionic Avionics Inc. - PySight Firmware - Damien P. George's MicroPython Technical Details The vulnerability occurs during the FAT32 mount process, specifically in the following code snippet: By constructing specific values (e.g., and ), the 32-bit multiplication overflows, causing to point to attacker-controlled FAT space. As a result, and can be spoofed, including the value of . Many downstream applications subsequently exhibit a classic vulnerability pattern: Since is controllable by the attacker, the final call may result in a stack or heap buffer overflow, leading to memory corruption and potential code execution. Remediation No specific remediation is currently provided on the page, but users are advised to update to the latest versions of affected products to resolve this vulnerability. Timeline 2026-03-17 (Tue): Initial discovery and recording. 2026-04-20 (Mon): CVE ID assigned. 2026-04-20 (Mon): Initial contact with vendor ChaN (no response). 2026-04-27 (Mon): Contacted JPCERT/CC for coordination assistance (Ref: JPCERT#96 280429). 2026-04-28 (Tue): JPCERT/CC contacted Japanese vendors (no response after three attempts). 2026-05-14 (Wed): Contacted major downstream implementers advised by JPCERT/CC (responded, but unwilling to receive detailed information). 2026-06-18 (Thu): Updated JPCERT/CC and downstream vendors, changing the disclosure date to July 1st. 2026-07-01 (Wed): Public disclosure of CVE-2026-6682. Author Information Author: Tod Beardsley Role: VP of Security Research at runZero Background: Former Section Chief at CSD/VM/VRC, Cybersecurity and Infrastructure Security Agency (CISA), and Election Judge in Travis County. With over 30 years of security experience, spanning from in-band telephone switching to modern ICS/OT implementations. Subscription Subscription options are provided at the bottom of the page, allowing users to enter their email address to receive the latest news and expert insights. --- The above is a summary of the key information regarding the vulnerability on the page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-6682: FatFs Integer Overflow Leading to RCE in FAT32 Mount