CVE-2026-6687

HighCVSS 7.6/10Last modified Oct 25, 2026

Description

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
ChaN	FatFs	<= R0.16

References

https://elm-chan.org/fsw/ff/Product
https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit
https://www.runzero.com/advisories/fatfs-exfat-label-len-of-cve-2026-6687/Third Party Advisory
https://www.runzero.com/blog/fatfs-bugs/Third Party Advisory, Exploit
https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit

Timeline

Published: Jul 1, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-668746.5For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow bran CVE-2026-668758.8In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–3 CVE-2026-668778.1Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's a CVE-2026-668787.7A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel CVE-2026-66887.6FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, f CVE-2026-668818.1Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled CVE-2026-668822.1Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-sit CVE-2026-668836.3Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user CVE-2026-668842.1Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attac CVE-2026-668856.5Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under CVE-2026-668879.6The affected products are missing authorization on state-changing CGIs and session checks are not performed.CVE-2026-66894.3Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when s