What is the CVSS score of CVE-2026-6688?

CVE-2026-6688 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of FatFs are affected by CVE-2026-6688?

FatFs R0.16 and earlier contains a buffer overflow in long filename handling that affects downstream applications integrating the library, potentially enabling memory corruption in embedded systems.

How to fix or mitigate CVE-2026-6688?

Within 24 hours: identify all products and embedded systems using FatFs R0.16 or earlier with FF_USE_LFN enabled; assess physical security controls around affected devices. Within 7 days: implement bounds checking in all downstream applications copying fno.fname output; disable FF_USE_LFN in FatFs configuration if long filename support is not operationally required. Within 30 days: establish monitoring for exploitation attempts; document upgrade requirements and timelines for when vendor patches become available.

FatFs CVE-2026-6688

EUVD-2026-41000 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-01 runZero

GHSA-8vm2-mjff-2gg2

Buffer Overflow Fatfs Chan

7.6

CVSS 3.1 · Vendor: runZero

Severity by source

Vendor (runZero) PRIMARY

7.6 HIGH

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

Physical media required (AV:P), no auth for parsing (PR:N); overflow stays within one process so S:U not S:C; memory corruption yields full C/I/A impact.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (runZero).

CVSS VectorVendor: runZero

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:51 vuln.today

DescriptionCVE.org

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

AnalysisAI

Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) returned in fno.fname are copied by downstream callers into short fixed-size buffers without bounds checks, corrupting memory in the embedded application. Reported by runZero, this is a downstream-caller (CWE-120) pattern affecting integrations of the popular ChaN FatFs embedded filesystem library rather than a defect in FatFs core parsing itself. Publicly available exploit code exists (SSVC Exploitation: PoC, runZero GitHub repo) with total technical impact, though the physical attack vector (AV:P) meaningfully constrains real-world reach; no CISA KEV listing.

Technical ContextAI

FatFs is a small, portable FAT/exFAT filesystem middleware written in C by ChaN (elm-chan.org), embedded into firmware for microcontrollers, IoT devices, and storage-handling appliances. When compiled with Long File Name support (FF_USE_LFN), directory enumeration via f_readdir/f_stat populates FILINFO.fname with names up to 255 characters, whereas legacy 8.3 short names fit in 13 bytes. The CPE cpe:2.3:a:chan:fatfs:*:*:*:*:*:*:*:* identifies the affected library, but the vulnerability is a CWE-120 (Buffer Copy without Checking Size of Input) pattern in downstream code that assumes short-name sizing and strcpy/memcpy's fno.fname into an undersized stack or static buffer, overflowing adjacent memory.

RemediationAI

No vendor-released patched version was identified at time of analysis, so remediation centers on hardening the integration: audit every caller of f_readdir/f_stat/FILINFO.fname and replace unchecked copies with bounded operations (strncpy/snprintf/memcpy sized to the destination and validated against FF_LFN_BUF/FF_MAX_LFN), which is the definitive fix. As a compensating control, disable long filename support by building with FF_USE_LFN=0 so fname is capped at the 13-byte 8.3 form - the trade-off is loss of long-filename functionality, which may break applications that depend on it. Where LFN must stay enabled, restrict which storage media the device will mount (reject untrusted removable media) and constrain physical access to media slots, since exploitation requires a crafted volume; monitor the vendor page https://elm-chan.org/fsw/ff/ for an updated FatFs release and follow the runZero advisory https://www.runzero.com/advisories/fatfs-long-fn-of-downstream-cve-2026-6688/ for remediation guidance.