FatFs FAT32 mount integer overflow leading to memory corruption

An integer overflow in FatFs's FAT32 mount path can be triggered by a crafted volume and lead to memory corruption and possible code execution on the parsing device. FatFs ships inside many embedded stacks (ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, SWUpdate). Disclosed by runZero on 2026-07-01; no upstream fix as of disclosure.

cat cve-2026-6682.json

Vendor: ChaN / FatFs upstream
Product: FatFs (as shipped in downstream RTOS / firmware distributions)
CVSS: 7.6
Status: unpatched
Published: July 3, 2026
Source: https://www.runzero.com/blog/fatfs-bugs/

Related coverage

~/articles/2026-07-03-fatfs-runzero-seven-flaws-embedded-firmware

supply chain

runZero discloses seven FatFs flaws in embedded firmware, six unpatched

runZero disclosed seven vulnerabilities in FatFs, a small filesystem library shipped inside ESP-IDF, STM32Cube, Zephyr, MicroPython, and other embedded stacks. Only one has an upstream fix.

Jul 3 read →