EUVD-2026-40996
GHSA-rggj-rv54-4gvx
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Physical access required per embedded context; no privileges needed; integrity and availability fully impacted; no confidentiality exposure from cache-skip bug.
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->sect - sect < cc) during interleaved read/write on fragmented filesystems. This maps to CWE-191 (Integer Underflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
AnalysisAI
Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleaved read/write operations on fragmented volumes. The condition fp->sect - sect < cc in f_read() and f_write() uses unsigned arithmetic - when sect exceeds fp->sect, the subtraction wraps to a large unsigned value, bypassing the required cache flush and leaving stale or inconsistent data on disk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical access to the target device is required (AV:P per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, score 6.1 Medium) indicates physical access is required, which substantially limits the realistic threat surface compared to network-exploitable vulnerabilities of similar CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An adversary with physical access to an embedded device (such as an industrial controller or IoT appliance) running firmware that uses FatFs mounts or interacts with a fragmented FAT volume - such as an SD card written across multiple non-contiguous clusters. By triggering a workload that interleaves f_read() and f_write() calls on the same file object across sector boundaries that cause unsigned wrap, the attacker causes the dirty-cache flush to be skipped, leaving inconsistent or attacker-influenced data persisted to disk instead of the correct content. … |
| Remediation | No vendor-released patched version has been independently confirmed in the available data - the fix version is not cited in any reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) ret
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount
Unbounded mount-time loop in FatFs prior to R0.16 allows physical attackers to cause a denial of service by presenting a
Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes
Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today