By vendor

Elm-Chan vulnerabilities

Known CVEs affecting Elm-Chan products, prioritized by severity, with SEC.co remediation and detection guidance.

6 published vulnerabilities

• CVE-2026-6682HIGH 7.6

  FatFS, a popular embedded file-system library, contains an integer overflow bug in its volume-mounting code that can be exploited to corrupt file-size metadata. When FatFS calculates the total size of the file allocation table during mount, a multiplication operation can wrap around due to insufficient bounds checking, allowing an attacker to supply a malicious disk image or FAT32 partition that causes the library to misinterpret file sizes. Downstream code that relies on these corrupted values can then read or write beyond intended boundaries, leading to memory corruption, information disclosure, or denial of service. The vulnerability affects FatFS version R0.16 and earlier.

• CVE-2026-6687HIGH 7.6

  FatFs R0.16 and earlier have a stack overflow vulnerability in the f_getlabel() function that can be triggered when processing exFAT filesystems. The bug occurs because the code trusts the exFAT label length field (XDIR_NumLabel) without validating it against specification limits. An attacker with physical access to a device can craft a malicious exFAT filesystem that, when mounted and processed by vulnerable FatFs code, causes a stack buffer overflow. This can lead to code execution or system compromise.

• CVE-2026-6688HIGH 7.6

  FatFs R0.16 and earlier has a buffer overflow vulnerability in how it handles long filenames. When long filename (LFN) support is enabled, the library can return filenames up to 255 characters, but application code that calls FatFs often copies these filenames into fixed-size buffers without checking the length first. This mismatch between what FatFs can return and what callers expect creates a classic overflow condition. An attacker with physical access to a storage device could craft a malicious filesystem with an exceptionally long filename to trigger the overflow and potentially execute code or crash the system.

• CVE-2026-6683MEDIUM 4.6

  FatFs R0.16 and earlier has a divide-by-zero defect in its exFAT sync code. When specially crafted filesystem metadata is processed during write or sync operations, internal calculations can attempt division by zero, crashing the file system handler. The vulnerability requires physical access or locally authenticated access in most scenarios, though network-delivered firmware or storage updates could theoretically enable remote exploitation in certain deployment contexts. The impact is denial of service—legitimate I/O operations will fail until the system is restarted or the corrupted metadata is removed.

• CVE-2026-6684MEDIUM 4.6

  FatFs, a widely-used embedded filesystem library, contains a denial-of-service vulnerability in versions before R0.16 when GPT (GUID Partition Table) scanning is enabled with 64-bit LBA support. An attacker with physical access to a storage device can craft a malicious GPT header with an extremely large or unbounded partition count value, causing any system mounting that device to enter an effectively infinite loop during initialization. This results in a hung or unresponsive device at mount time, disrupting availability without requiring authentication or user interaction.

• CVE-2026-6686MEDIUM 4.6

  FatFs R0.16 and earlier has a flaw where the f_lseek() function can expose uninitialized data when it extends a file beyond its current end without properly clearing the newly allocated disk clusters. An attacker with physical access to a system could read sensitive information from unallocated or previously used disk space by crafting a file system that triggers this behavior.