EUVD-2026-40999
GHSA-wghw-hg6m-7rh3
Severity by source
AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Physical delivery of crafted exFAT media (AV:P), no auth or interaction (PR:N/UI:N); library runs in one context so S:U, with full memory-corruption impact yielding C/I/A:H.
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
AnalysisAI
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt the stack via f_getlabel(), because the exFAT volume-label length field (XDIR_NumLabel) is trusted without enforcing the specification maximum. FatFs is an embedded FAT/exFAT filesystem library used across microcontroller and IoT firmware, so any device that mounts and reads the label of attacker-supplied storage is exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to mount and read the volume label of an attacker-controlled exFAT filesystem image - the vulnerable path is f_getlabel() on an exFAT volume, so builds compiled without exFAT support (FF_FS_EXFAT disabled) are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS v3.1 vector (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 7.6 High) hinges on physical attack vector - the attacker must supply crafted exFAT media to the target, which sharply limits mass exploitation compared to a network-facing bug, so despite the High score real-world urgency is moderate and situational. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an exFAT-formatted SD card or USB stick whose volume directory entry declares an oversized label length, then physically inserts it into a target device (kiosk, industrial controller, IoT appliance) that automatically reads the volume label via f_getlabel(). Parsing the malicious label overflows the stack buffer, corrupting the return address and enabling denial of service or arbitrary code execution on the embedded target. … |
| Remediation | Upgrade FatFs to the fixed upstream release published after R0.16 from https://elm-chan.org/fsw/ff/ once available; the reference data does not name an exact patched version, so treat this as 'upstream fix available (advisory/commit); released patched version not independently confirmed' and pin to the specific corrected revision from the vendor page before rebuilding firmware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems and firmware versions using FatFs library (check vendor documentation, firmware release notes, embedded device BOMs, and supply chain data). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) ret
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount
Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleav
Unbounded mount-time loop in FatFs prior to R0.16 allows physical attackers to cause a denial of service by presenting a
Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes
Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today