CVE-2026-6682: FatFS R0.16 Integer Overflow in FAT32 Mount Vulnerability

Technical summary

The vulnerability resides in the mount_volume() function where the expression fasize *= fs->n_fats performs an unchecked multiplication. If the number of file allocation tables (n_fats) and the initial FAT sector size (fasize) are large enough, their product overflows a 32-bit unsigned integer, wrapping to a small value. This wrapped value is then used in subsequent I/O operations and buffer allocations, causing the library to either over-read from the disk or under-allocate memory. The flaw is classified as CWE-190 (Integer Overflow or Wraparound). Exploitation requires either direct control over a disk image presented to the device or insertion of a malicious FAT32 partition into an OTA (over-the-air) update stream, making it a vector in embedded systems, IoT devices, and firmware update pipelines.

Business impact

Organizations relying on FatFS in embedded products—including IoT devices, industrial controllers, automotive systems, and firmware updaters—face potential data corruption, device instability, and unauthorized information access. A successful exploit can render devices unbootable, corrupt stored data, or leak sensitive information from memory. In supply-chain or OTA update contexts, the attack surface expands significantly, as an attacker could poison update images to compromise large device fleets. Recovery may require physical access to reprovision or repair devices, incurring substantial operational and support costs.

Affected systems

FatFS R0.16 and earlier are affected. FatFS is widely embedded in microcontroller firmware, real-time operating systems (RTOS), and embedded Linux systems. Products commonly using FatFS include ARM-based microcontrollers, automotive infotainment systems, storage devices, industrial IoT platforms, and many third-party firmware implementations. Organizations should audit their bill of materials and firmware source trees for FatFS versions, paying particular attention to components handling untrusted disk images or OTA updates.

Exploitability

The CVSS vector indicates physical attack vector (AV:P), meaning an attacker typically needs direct or local access to insert or modify a malicious FAT32 partition. However, the description explicitly notes that remote delivery is possible in OTA and update pipelines, which significantly lowers the practical barrier in connected-device deployments. The CISA SSVC assessment rates exploitation at PoC maturity, indicating proof-of-concept code may exist or be readily constructible. No active in-the-wild exploitation has been confirmed at publication, but the exploit complexity is low (AC:L), requiring only a specially crafted disk image.

Remediation

Upgrade FatFS to a patched version released after R0.16. Verify with elm-chan's official repository or distribution channel for the specific patch version. Organizations unable to immediately update should implement compensating controls: validate FAT32 partition metadata before passing it to FatFS, run FatFS in a sandboxed process with restricted memory and I/O access, and disable OTA updates from untrusted sources until patched. For devices already in the field, prioritize those exposed to untrusted storage media or update streams.

Patch guidance

Check elm-chan's official FatFS repository for versions released after R0.16. Apply patches to all affected firmware builds and thoroughly test on representative hardware before deployment. For OTA-capable devices, coordinate patched firmware releases with strong integrity verification (e.g., signed manifests, staged rollout). Confirm in release notes or commit logs that the integer overflow in mount_volume() has been addressed. Consider adding automated version checks in your build pipeline to prevent accidental use of vulnerable versions.

Detection guidance

Monitor for failed file-system mounts, memory access violations, or unusual buffer overruns in FatFS code paths when processing untrusted storage media. In firmware update contexts, flag OTA payloads with malformed or suspicious FAT32 headers (unusually large cluster counts, invalid n_fats values). Log all disk-mount operations and partition metadata inspection. On devices with debug UART or logging enabled, watch for mount failures preceded by partition-read operations that trigger memory protection exceptions. Audit version strings in running firmware to identify deployed instances of FatFS R0.16 or earlier.

Why prioritize this

Despite a physical attack vector, the explicit mention of remote delivery through OTA pipelines, combined with the HIGH CVSS score (7.6) reflecting complete confidentiality, integrity, and system-wide impact, makes this a priority for organizations with embedded or IoT footprints. The low exploit complexity and lack of user interaction (UI:N) mean that once a malicious disk image or OTA payload is crafted, exploitation is reliable. For devices in the field that receive firmware updates, the attack surface is immediate and should be addressed before release.

Risk score, explained

The CVSS 7.6 (HIGH) score reflects multiple high-impact consequences: complete confidentiality loss (C:H) through memory leakage, complete integrity loss (I:H) through metadata corruption, and complete availability loss (A:H) through system crash or device brick. The scope is changed (S:C), meaning the vulnerability can impact resources beyond the FatFS library itself, such as adjacent kernel memory or other processes. The primary limitation is the physical attack vector, which typically requires local or direct access; however, OTA/update pipelines often reduce this constraint in practice, justifying the elevated score.

Frequently asked questions