CVE-2026-6682: falha de alta gravidade em ChaN FatFs
FatFs Integer Overflow in FAT32 Volume Mount
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.3%
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
ChaN · FatFsCVEs relacionadas — ChaN FatFs
No mesmo produto, das mais perigosas para as menos.
CVE-2026-6687HIGHFatFs Stack Buffer Overflow via Uncapped exFAT Label LengthEPSS 0.3%CVE-2026-6688HIGHFatFs Buffer Overflow via Unbounded LFN Filename CopyEPSS 0.3%CVE-2026-6684MEDIUMFatFs Infinite Loop in GPT Partition ScanEPSS 0.3%CVE-2026-6683MEDIUMFatFs Divide-by-Zero in exFAT SyncEPSS 0.3%CVE-2026-6686MEDIUMFatFs Use of Uninitialized Clusters After Seek Past EOFEPSS 0.3%