EUVD-2026-40994
GHSA-vhc7-qgwj-vx6v
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Physical media insertion is required (AV:P); no privileges or user interaction needed; only availability is impacted (A:H) via mount-time hang with no data exposure.
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
Lifecycle Timeline
1DescriptionCVE.org
FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
AnalysisAI
Unbounded mount-time loop in FatFs prior to R0.16 allows physical attackers to cause a denial of service by presenting a crafted GPT disk image with an arbitrarily large GPTH_PtNum partition count field. The flaw is present only in builds where the FF_LBA64 = 1 compile-time flag is set, enabling 64-bit LBA and GPT scanning support. A public proof-of-concept is available from runZero; no confirmed active exploitation (CISA KEV) has been observed, and SSVC categorizes technical impact as partial, limited to availability.
Technical ContextAI
FatFs (elm-chan FatFs) is a lightweight, open-source FAT/exFAT filesystem library written in C and widely embedded in microcontrollers, RTOS environments, and bare-metal systems. When compiled with the FF_LBA64 = 1 configuration flag - which unlocks 64-bit Logical Block Addressing and GUID Partition Table (GPT) support for large storage devices - the library parses the GPT header field GPTH_PtNum to determine how many partition entries to iterate over during mount. CWE-835 (Loop with Unreachable Exit Condition) applies because FatFs uses this attacker-controlled integer directly as the loop iteration bound without imposing a sane upper limit or sanity-checking it against the actual disk geometry. Presenting a GPT header with GPTH_PtNum set to a maximum or near-maximum value causes the scan loop to run for an effectively infinite number of cycles, stalling or permanently blocking the mount operation. The CPE identifier is cpe:2.3:a:chan:fatfs:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade FatFs to R0.16 or later, which is the vendor-designated patched release resolving the unbounded GPTH_PtNum loop; source is available at https://elm-chan.org/fsw/ff/. If upgrading is not immediately feasible in firmware-constrained environments, the most effective mitigation is to recompile FatFs with FF_LBA64 = 0 or omit GPT scanning entirely if the application does not require support for GPT-partitioned media larger than 2 TB - this removes the vulnerable code path with no functional impact for devices using MBR-formatted media. Alternatively, integrating an application-layer validation wrapper that bounds GPTH_PtNum to a sane maximum (e.g., 128 or 256 partition entries) before invoking FatFs mount routines eliminates the unbounded loop without a library upgrade; the trade-off is that this requires careful code review to ensure the wrapper is always invoked and cannot be bypassed. Physical security controls - locking or disabling external media ports via hardware or firmware policy - remove the attack surface for deployed devices where GPT media insertion by untrusted parties is the threat model.
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) ret
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount
Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleav
Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes
Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today