CVE-2026-6686

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier

Description An uninitialized cluster exposure occurs when the f lseek() function extends files beyond the end-of-file (EOF) without zero-filling newly allocated clusters. This issue is a Use of Uninitialized Resource, where the system fails to clear memory or storage before use, potentially exposing sensitive data previously stored in those clusters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.