Christopher Williams
dbd6192332
July 10, 2026 Some vulnerabilities in FatFs R0.16 and earlier have been found and published. CVE-2026-6682 (*) A FAT BPB with broken FAT size field can collapse the files or lead a system crash. CVE-2026-6687 (*) An exFAT volume label with manipulated name length field can lead a buffer overflow. CVE-2026-6688 LFN length is 255 UTF-16 encode units maximum. Please make sure the size of buffer is sufficient to copy the read file name. CVE-2026-6685 Wraparound in these expressions are intentional and not harmful. CVE-2026-6683 (*) An exFAT BPB with manipulated cluster count field can trigger a /0 and lead the system crash. CVE-2026-6686 This behavior has been documented in the manual. Please be careful. CVE-2026-6684 A manipulated table size field in GPT header can lead the system freeze. It does not cover FatFs R0.16. This publishment of problems was reported via an SNS.
= FatFs This is a copy of FatFs, a "generic FAT file system module for small embedded systems", by ChaN. See http://elm-chan.org/fsw/ff/00index_e.html. Please submit bug reports to the http://elm-chan.org/fsw/ff/bd/[FatFs User Forum], not to this repo. == License Copyright (C) 2022, ChaN, all right reserved. FatFs module is an open source software. Redistribution and use of FatFs in source and binary forms, with or without modification, are permitted provided that the following condition is met: 1. Redistributions of source code must retain the above copyright notice, this condition and the following disclaimer. This software is provided by the copyright holder and contributors "AS IS" and any warranties related to this software are DISCLAIMED. The copyright owner or contributors be NOT LIABLE for any damages caused by use of this software.