FatFs exFAT volume-label buffer overflow
A buffer overflow in FatFs's handling of exFAT volume labels can be triggered by a crafted volume presented to the parser. FatFs is embedded in many RTOS and firmware distributions. Disclosed by runZero on 2026-07-01 alongside six other FatFs CVEs; no upstream fix as of disclosure.
- Vendor
- ChaN / FatFs upstream
- Product
- FatFs (as shipped in downstream RTOS / firmware distributions)
- CVSS
- 7.6
- EPSS (exploit probability)
- 0.3%
- Status
- unpatched
- Published
A buffer overflow in FatFs’s exFAT volume-label parsing can be triggered by a specially crafted volume presented to the library. The overflow occurs in the code that reads the volume label field of an exFAT filesystem and can lead to memory corruption on the embedded device parsing it.
The flaw was disclosed by runZero on July 1, 2026 as part of a seven-CVE disclosure covering the FatFs library, which is embedded in many RTOS and firmware distributions including ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, and SWUpdate. No upstream fix had been released as of disclosure.
Mitigation: Monitor your downstream RTOS or firmware vendor’s security advisories for a backported patch. See runZero’s full disclosure for technical detail. Full coverage: FatFs — runZero Discloses Seven Embedded Firmware Flaws.
