FatFs FAT32 mount integer overflow leading to memory corruption
An integer overflow in FatFs's FAT32 mount path can be triggered by a crafted volume and lead to memory corruption and possible code execution on the parsing device. FatFs ships inside many embedded stacks (ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, SWUpdate). Disclosed by runZero on 2026-07-01; no upstream fix as of disclosure.
- Vendor
- ChaN / FatFs upstream
- Product
- FatFs (as shipped in downstream RTOS / firmware distributions)
- CVSS
- 7.6
- EPSS (exploit probability)
- 0.3%
- Status
- unpatched
- Published
An integer overflow in FatFs’s FAT32 volume-mount path can be triggered by a specially crafted storage volume and leads to memory corruption on the parsing device. Successful exploitation may result in code execution in the context of the embedded application reading the filesystem.
FatFs is a widely embedded FAT filesystem library included in many RTOS and firmware distributions — ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, and SWUpdate are all affected downstream. The flaw was disclosed by runZero on July 1, 2026 alongside six other FatFs CVEs; no upstream fix had been released as of disclosure.
Mitigation: Check whether your firmware distribution has backported a fix; monitor runZero’s FatFs disclosure and your RTOS vendor’s security advisories. Where possible, restrict parsing of untrusted or externally supplied storage volumes. Full coverage: FatFs — runZero Discloses Seven Embedded Firmware Flaws.
