FatFs Vulnerabilities Let Attackers Execute Code via Crafted USB and SD Card Images

A newly disclosed set of vulnerabilities in the widely used FatFs file system library is raising significant concerns across the embedded systems ecosystem.

Researchers are warning that specially crafted USB drives and SD card images can trigger memory corruption and, in some cases, allow for remote code execution.

The findings, published by runZero researchers Tod Beardsley and HD Moore, detail seven distinct vulnerabilities tracked as CVE-2026-6682 through CVE-2026-6688, which affect numerous platforms, including Espressif ESP-IDF, STM32Cube, Zephyr RTOS, MicroPython, and TizenRT.

FatFs Vulnerabilities

FatFs is a lightweight FAT/exFAT file system implementation commonly embedded in firmware. It is extensively deployed across consumer IoT devices, industrial systems, drones, and cryptocurrency hardware wallets.

Its widespread adoption, combined with frequent vendor-side modifications, creates a large and fragmented attack surface. According to the researchers, the vulnerabilities can be exploited through specially crafted FAT, exFAT, or GPT disk images delivered via removable media or automated update mechanisms.

The most critical issue, tracked as CVE-2026-6682 (CVSS 7.6), involves an integer overflow in the mount_volume() function. This flaw allows attackers to manipulate file-size metadata, potentially leading to heap- or stack-based buffer overflows during file operations.

Another high-severity flaw, CVE-2026-6687, affects the f_getlabel() function in exFAT implementations, where improper validation of label length can result in stack-based buffer overflows when handling oversized volume labels.

Additionally, CVE-2026-6688 highlights a recurring vulnerability pattern in downstream integrations, where long filename (LFN) handling exceeds expected buffer sizes in application code.

This issue is particularly challenging to address at the library level because it stems from unsafe string-handling practices in dependent firmware.

Medium-severity issues include CVE-2026-6685, which involves an unsigned arithmetic wraparound in cache handling that can lead to silent data corruption, and CVE-2026-6683.

This divide-by-zero flaw can cause device crashes during exFAT write operations. The latter poses a significant risk during over-the-air (OTA) update workflows, potentially resulting in device bricking.

CVE-2026-6686 exposes uninitialized data when files are extended beyond the end of the file (EOF), potentially leaking residual data. Meanwhile, CVE-2026-6684 enables denial-of-service attacks by causing excessive GPT partition scanning in older versions of FatFs.

Notably, the researchers revisited earlier audit efforts from 2017 and, in 2026, leveraged modern AI-assisted fuzzing techniques. By using GitHub Copilot to generate fuzzing harnesses automatically, they identified vulnerabilities that had previously gone unnoticed, demonstrating the growing role of AI in the discovery of security flaws.

Despite attempts to coordinate the disclosure of these vulnerabilities, the upstream maintainer did not respond. This prompted researchers to urge downstream vendors to audit their implementations, validate patches, and review file-handling logic.

Given the lack of memory protections, such as Address Space Layout Randomization (ASLR), in many embedded environments, even brief physical access to affected devices could result in a complete system compromise.

The researchers emphasize that as AI-driven vulnerability discovery becomes more accessible, similar flaws in widely reused components such as FatFs are unlikely to remain undiscovered for long, increasing the urgency of proactive remediation.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN