CVE-2026-6682

HighCVSS 7.6/10Last modified Oct 25, 2026

Description

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
ChaN	FatFs	<= R0.16

References

https://elm-chan.org/fsw/ff/Product
https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit
https://www.runzero.com/advisories/fatfs-fat32-int-of-mnt-cve-2026-6682/Third Party Advisory, Exploit
https://www.runzero.com/blog/fatfs-bugs/Third Party Advisory, Exploit
https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit

Timeline

Published: Jul 1, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-668208.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-668225.9Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-668249.2A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture CVE-2026-668256.9Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, CVE-2026-668296.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker CVE-2026-66834.6FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/CVE-2026-668326.5When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as CVE-2026-668358.2Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected CVE-2026-668378.7Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift CVE-2026-668388.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Inject CVE-2026-668398.4NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An au CVE-2026-66844.6FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field