PatchTheCVEfatfs vulnerabilities and fixes
Recent CVEs affecting fatfs, with upgrade or downgrade steps. 6 tracked.
fatfs has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-07-01. Highest priority: CVE-2026-6687 (score 39/100).
- CVE-2026-6687 HIGH 7.6 UPGRADE FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabe
- CVE-2026-6682 HIGH 7.6 UPGRADE In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats
- CVE-2026-6688 HIGH 7.6 UPGRADE FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename
- CVE-2026-6683 MEDIUM 4.6 UPGRADE FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_faten
- CVE-2026-6684 MEDIUM 4.6 UPGRADE FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count
- CVE-2026-6686 MEDIUM 4.6 UPGRADE FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF wit
FAQ
How do I fix fatfs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fatfs being exploited right now?
None of the tracked fatfs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fatfs CVE should I patch first?
CVE-2026-6687 currently ranks highest (39/100): FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabe.