What is the CVSS score of CVE-2026-6686?

CVE-2026-6686 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

FatFs CVE-2026-6686

EUVD-2026-40998 MEDIUM

Use of Uninitialized Resource (CWE-908)

2026-07-01 runZero

GHSA-h94p-vjqx-v7rr

Information Disclosure Fatfs Chan

4.6

CVSS 3.1 · Vendor: runZero

Severity by source

Vendor (runZero) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.6 MEDIUM

Physical access to storage is required to both trigger the f_lseek gap and read residual clusters; no authentication needed once access is obtained, with no integrity or availability impact.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (runZero).

CVSS VectorVendor: runZero

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:51 vuln.today

DescriptionCVE.org

FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

AnalysisAI

Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a file beyond its current EOF without zeroing newly allocated FAT clusters. Any application or device reading the extended region receives raw, previously written sector content instead of zeroed bytes, leaking sensitive residual storage data such as deleted file fragments or cryptographic material. A proof-of-concept exploit exists per SSVC and runZero's GitHub repository; no active exploitation has been confirmed in CISA KEV.

Technical ContextAI

FatFs is a lightweight, open-source FAT filesystem library maintained by elm-chan (CPE: cpe:2.3:a:chan:fatfs:*:*:*:*:*:*:*:*) and widely embedded as source code directly into microcontroller firmware, IoT devices, data loggers, and bare-metal systems requiring FAT12, FAT16, or FAT32 support. The root cause is CWE-908 (Use of Uninitialized Resource): the f_lseek() function, when used to seek past the current end-of-file, causes FatFs to allocate new FAT cluster chain entries for the created gap region. However, the library does not issue zeroing write operations to those clusters before marking them as belonging to the file. Subsequent reads of the gap region by the application or any other accessor of the storage medium return the raw sector content left by previous disk operations - effectively a stale data disclosure channel inherited from deleted files or prior filesystem activity.

RemediationAI

The primary fix is to upgrade to a version of FatFs released after R0.16 once the upstream maintainer elm-chan publishes a patched release; no confirmed fixed version number is available in the current input data, so the runZero advisory at https://www.runzero.com/advisories/fatfs-uninit-cluster-exposure-cve-2026-6686/ and the upstream distribution page at https://elm-chan.org/fsw/ff/ should be monitored for patch announcements. As an immediate compensating control, integrators can patch f_lseek() locally within their firmware to explicitly zero-fill all newly allocated cluster sectors before returning control to the caller - this eliminates the uninitialized data exposure at the cost of additional write I/O and slightly increased seek latency during sparse file extension. Alternatively, applications can be refactored to avoid f_lseek()-based gap creation entirely, instead writing explicit zero-padded data to extend files, though this changes application semantics. Physical access controls to devices using FatFs-managed storage further reduce exploitation opportunity given the AV:P attack vector requirement.