Eclipse FileX CVE-2026-91041

Exploitation requires (1) the FileX fault tolerance feature to be enabled, and (2) the device to mount an attacker-controlled/malformed FAT image, which triggers the vulnerable log-replay path (UI:R - a mount action against attacker-supplied media must occur). Reliable instruction-pointer control additionally depends on 'a common embedded memory layout' that places the FX_MEDIA driver callback within reach of the attacker-positioned write, so success is target/build-dependent. Limiting factors: local attack vector (no network path), the need to deliver untrusted media to the device, and reliance on fault tolerance being configured - devices that never mount untrusted FAT images or run without fault tolerance are not realistically exposed.

This is a genuinely serious memory-corruption vulnerability but with meaningful real-world gating. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) indicates local attack vector with required user interaction, and the description confirms an attacker-positioned, attacker-valued out-of-bounds heap write that can reach the FX_MEDIA driver callback and hijack the instruction pointer - i.e., realistic remote-code-execution potential on affected embedded targets. The high technical impact (full C/I/A compromise via IP control) argues for priority. However, several signals temper urgency: no EPSS score was provided, there is no CISA KEV listing, and no public POC was referenced, so there is no evidence of active exploitation or at-scale weaponization. The AV:L plus UI:R combination means exploitation is not remote-unauthenticated over a network - it requires the target system to mount an attacker-controlled FAT image, and the author notes IP control depends on 'a common embedded memory layout,' implying reliability varies across builds/targets. Net: treat as a high-priority patch for devices that mount untrusted FAT media with fault tolerance enabled, but it is not a drive-by internet-facing threat. Note the stated IP-control outcome is plausibly higher-impact than the 7.8 (Scope:Unchanged, local) suggests for devices with no privilege boundary - verify against your specific deployment.

An attacker crafts a malformed FAT filesystem image containing a corrupted fault-tolerance log and gets it onto removable media (e.g., USB/SD) or otherwise supplied to the device. When the device mounts the image with fault tolerance enabled, log replay performs an out-of-bounds heap write at an attacker-chosen location with an attacker-chosen value, overwriting the FX_MEDIA driver callback pointer and redirecting the instruction pointer to attacker code. No public exploit code was identified at time of analysis.