What is the CVSS score of CVE-2026-6685?

CVE-2026-6685 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

FatFs CVE-2026-6685

Q: Which versions of FatFs are affected by CVE-2026-6685?

Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleaved read/write operations on fragmented volumes.

EUVD-2026-40996 MEDIUM

Integer Underflow (CWE-191)

2026-07-01 runZero

GHSA-rggj-rv54-4gvx

Information Disclosure Integer Overflow Fatfs Chan

6.1

CVSS 3.1 · Vendor: runZero

Severity by source

Vendor (runZero) PRIMARY

6.1 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.1 MEDIUM

Physical access required per embedded context; no privileges needed; integrity and availability fully impacted; no confidentiality exposure from cache-skip bug.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (runZero).

CVSS VectorVendor: runZero

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:54 vuln.today

DescriptionCVE.org

FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->sect - sect < cc) during interleaved read/write on fragmented filesystems. This maps to CWE-191 (Integer Underflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

AnalysisAI

Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleaved read/write operations on fragmented volumes. The condition fp->sect - sect < cc in f_read() and f_write() uses unsigned arithmetic - when sect exceeds fp->sect, the subtraction wraps to a large unsigned value, bypassing the required cache flush and leaving stale or inconsistent data on disk. A proof-of-concept exists per SSVC assessment, and technical impact is rated Total, though physical access is required per the CVSS vector. No confirmed active exploitation (not in CISA KEV).

Technical ContextAI

FatFs (cpe:2.3:a:chan:fatfs:*:*:*:*:*:*:*:*) is a generic FAT/exFAT filesystem middleware library by ChaN (elm-chan.org), widely embedded in microcontroller projects targeting STM32, AVR, PIC, and similar platforms where it handles SD cards, USB mass storage, and on-chip flash. The vulnerability is rooted in CWE-191 (Integer Underflow): the sector comparison expression fp->sect - sect < cc is evaluated using C unsigned integer arithmetic. When the sector pointer sect is greater than the file's cached sector fp->sect, the subtraction underflows to a very large unsigned number, which satisfies < cc falsely or fails the condition incorrectly, causing the library to skip flushing its dirty sector cache. On fragmented filesystems - where sector numbers for a given file are non-contiguous - this scenario arises naturally during interleaved read/write sequences, meaning normal application workloads on real-world storage media can trigger the bug without adversarial crafting.

RemediationAI

No vendor-released patched version has been independently confirmed in the available data - the fix version is not cited in any reference. Upstream research and PoC code are available at https://github.com/runZeroInc/vulns-2026-fatfs-chance, which may contain a proposed fix or patch diff; firmware maintainers should review this repository and apply any available patch to their local FatFs copy before rebuilding. As a compensating control, applications can serialize all read/write access to a given file object to avoid interleaved operations, which eliminates the fragmented-sector code path that triggers the underflow - though this may require application-level locking and adds latency overhead. Restricting FatFs usage to read-only or write-only modes per file object (never mixing both on the same FIL instance) is a second workaround with minimal performance trade-off but requires application refactoring. Firmware owners should monitor https://elm-chan.org/fsw/ff/ for an updated release from ChaN.