CVE-2026-6682

Name of the Vulnerable Software and Affected Versions FatFS versions R0.16 and earlier

Description An integer overflow occurs in the mount volume() function during FAT32 processing when the operation fasize *= fs->n fats wraps. This allows an attacker to control file-size metadata, resulting in unsafe read lengths for downstream callers. This issue can be exploited via crafted FAT images on USB sticks or SD cards to achieve arbitrary code execution on embedded devices, including those using ESP-IDF, STM32Cube, Zephyr, and ArduPilot. Additionally, remote delivery is possible through OTA or update pipelines. Real-world exploitation has been demonstrated on a camera device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.