FatFs long filename overflow in wrapper code

An overflow in FatFs's long-filename wrapper code can be triggered by a crafted filesystem entry. FatFs is embedded across many RTOS and firmware distributions. Disclosed by runZero on 2026-07-01 alongside six other FatFs CVEs; no upstream fix as of disclosure.

cat cve-2026-6688.json

Vendor: ChaN / FatFs upstream
Product: FatFs (as shipped in downstream RTOS / firmware distributions)
CVSS: 7.6
Status: unpatched
Published: July 3, 2026
Source: https://www.runzero.com/blog/fatfs-bugs/

Related coverage

~/articles/2026-07-03-fatfs-runzero-seven-flaws-embedded-firmware

supply chain

runZero discloses seven FatFs flaws in embedded firmware, six unpatched

runZero disclosed seven vulnerabilities in FatFs, a small filesystem library shipped inside ESP-IDF, STM32Cube, Zephyr, MicroPython, and other embedded stacks. Only one has an upstream fix.

Jul 3 read →