EUVD-2026-40992
GHSA-c25x-vcg6-4ccx
Severity by source
AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base trigger is mounting attacker-supplied media (AV:P), needing no auth or interaction (PR:N/UI:N); parser overflow crosses into downstream callers (S:C) with memory-corruption impact (C/I/A:H).
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
Lifecycle Timeline
1DescriptionCVE.org
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
AnalysisAI
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount_volume(), where fasize *= fs->n_fats wraps and produces attacker-controlled, oversized read lengths in downstream callers. The affected code is a widely embedded FAT filesystem library used across microcontrollers and IoT firmware, and while primarily triggered by mounting malicious media, the vendor notes remote delivery is feasible via OTA/update pipelines. Publicly available exploit code exists (runZero research and proof-of-concept repository); no public exploit identified as actively used and it is not listed in CISA KEV.
Technical ContextAI
FatFS is Chan's (elm-chan.org) generic FAT/exFAT filesystem module written in C for embedded and resource-constrained systems, referenced here by cpe:2.3:a:chan:fatfs. The root cause is CWE-190 (Integer Overflow or Wraparound): inside mount_volume(), the FAT area size computation fasize *= fs->n_fats multiplies a FAT sector count by the number of FATs without bounds checking, so a maliciously crafted FAT32 boot sector/BPB can make the product wrap around a fixed-width integer. The wrapped value then flows into file-size metadata and read-length calculations used by downstream callers (e.g. f_read paths), producing unsafe, oversized or miscomputed lengths. Because the library runs with full privilege inside firmware and parses untrusted on-disk structures before any validation, the miscalculated lengths can drive out-of-bounds memory access.
RemediationAI
Upgrade the FatFS module to a release later than R0.16 that contains the fixed mount_volume() bounds handling; consult the upstream project at https://elm-chan.org/fsw/ff/ for the corrected source and the runZero advisory (https://www.runzero.com/advisories/fatfs-fat32-int-of-mnt-cve-2026-6682/) for details - no exact fixed release version was provided in the input, so treat the patched version as 'per vendor/upstream advisory' rather than an assumed number and confirm the specific commit before shipping. Because FatFS is compiled into firmware, remediation means rebuilding and redeploying affected images rather than applying a runtime patch. Where an immediate rebuild is not possible, apply compensating controls: refuse to auto-mount untrusted removable media and require explicit operator action before mounting (trade-off: breaks plug-and-play workflows), add a pre-mount validation layer that sanity-checks FAT32 BPB fields (n_fats and FAT sector counts) against the reported volume size before calling mount_volume() (trade-off: engineering effort and possible rejection of unusual-but-valid volumes), and for OTA/update pipelines cryptographically sign and verify any filesystem/firmware image before it is mounted or parsed (trade-off: requires signing infrastructure but closes the remote-delivery path).
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) ret
Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleav
Unbounded mount-time loop in FatFs prior to R0.16 allows physical attackers to cause a denial of service by presenting a
Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes
Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today