EUVD-2026-40999
GHSA-wghw-hg6m-7rh3
Severity by source
AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Physical delivery of crafted exFAT media (AV:P), no auth or interaction (PR:N/UI:N); library runs in one context so S:U, with full memory-corruption impact yielding C/I/A:H.
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
Lifecycle Timeline
1DescriptionCVE.org
FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
AnalysisAI
Stack-based buffer overflow in FatFs R0.16 and earlier allows an attacker who can present crafted exFAT media to corrupt the stack via f_getlabel(), because the exFAT volume-label length field (XDIR_NumLabel) is trusted without enforcing the specification maximum. FatFs is an embedded FAT/exFAT filesystem library used across microcontroller and IoT firmware, so any device that mounts and reads the label of attacker-supplied storage is exposed. Publicly available exploit code exists (runZero advisory and SSVC 'PoC'), but there is no public exploit identified in active use and it is not listed in CISA KEV.
Technical ContextAI
FatFs is a small, widely embedded filesystem middleware by ChaN (cpe:2.3:a:chan:fatfs) that implements FAT12/16/32 and exFAT for resource-constrained systems. The flaw is CWE-121 (stack-based buffer overflow): when handling an exFAT volume directory entry, f_getlabel() reads the XDIR_NumLabel field that encodes the label character count and copies that many UTF-16 units into a fixed-size stack buffer sized for the exFAT maximum of 11 label characters. Because the on-disk length is used directly instead of being clamped to the spec maximum, a manipulated exFAT filesystem image declaring an oversized label overruns the stack buffer, corrupting adjacent stack memory such as saved registers and return addresses.
RemediationAI
Upgrade FatFs to the fixed upstream release published after R0.16 from https://elm-chan.org/fsw/ff/ once available; the reference data does not name an exact patched version, so treat this as 'upstream fix available (advisory/commit); released patched version not independently confirmed' and pin to the specific corrected revision from the vendor page before rebuilding firmware. Where an immediate rebuild is not possible, add a bounds check in the exFAT label-parsing path to clamp XDIR_NumLabel to the 11-character exFAT maximum before copying, or disable exFAT support (FF_FS_EXFAT=0) if the deployment does not require exFAT - the trade-off being loss of exFAT volume compatibility. As a deployment-level control, prevent untrusted removable media from being mounted (physically restrict USB/SD access or gate auto-mount), accepting the operational cost of manual media handling. Follow the runZero advisory at https://www.runzero.com/advisories/fatfs-exfat-label-len-of-cve-2026-6687/ for updated fix guidance.
Buffer overflow in FatFs R0.16 and earlier arises when long filenames (up to 255 characters, enabled via FF_USE_LFN) ret
Integer overflow in ELM-Chan FatFS R0.16 and earlier lets a crafted FAT32 volume corrupt file-size metadata during mount
Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleav
Unbounded mount-time loop in FatFs prior to R0.16 allows physical attackers to cause a denial of service by presenting a
Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes
Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today