Seven FatFs Vulnerabilities Expose Millions of Embedded Devices to Memory Corruption and Code Execution

Security researchers at runZero have disclosed seven vulnerabilities in FatFs, a small filesystem library used by millions of embedded devices worldwide. Consequently, any device that reads FAT or exFAT storage — including security cameras, drones, industrial controllers, and hardware crypto wallets — may be at risk of memory corruption and remote code execution through malicious USB drives or SD cards.

What Happened: FatFs Vulnerabilities Expose Millions of Embedded Devices to Memory Corruption Attacks

On July 1, 2026, runZero published its findings on seven previously undisclosed flaws in FatFs, an open-source filesystem library maintained by a single developer in Japan. Moreover, the library is embedded in the firmware of countless IoT, industrial, and consumer devices across the globe.

The most severe vulnerability, CVE-2026-6682, carries a CVSS score of 7.6 (High). Furthermore, it stems from an integer overflow during FAT32 volume mounting that can lead to memory corruption and code execution. In addition, six other flaws — ranging from buffer overflows to divide-by-zero crashes — compound the risk across the entire library.

The disclosure is especially concerning because FatFs has no security mailing list and no upstream patch for the memory-corruption bugs. Also, the lone maintainer has not responded to repeated contact attempts by runZero or Japan’s JPCERT/CC coordination center. Therefore, downstream vendors must patch independently, and many may never do so.

Technical Details of the FatFs Vulnerabilities

All seven flaws share a common root cause. Furthermore, when FatFs processes a deliberately malformed storage volume or firmware image, it mishandles bad data in ways that corrupt memory or crash the device.

On systems without the memory protections found on phones and desktops — which is typical for embedded devices — an attacker who gets a booby-trapped USB drive or SD card onto a device can corrupt its memory and execute arbitrary code. Also, some flaws are reachable through firmware updates, not just physical media.

runZero ranked the seven vulnerabilities from worst to least severe as follows:

• CVE-2026-6682 (CVSS 7.6, High): Integer overflow in FAT32 mount code produces a false file size, which later code treats as a real read length. Therefore, this can become memory corruption and code execution on real hardware. Also reachable through some firmware updates.
• CVE-2026-6687 (CVSS 7.6, High): The exFAT volume-label field overflows a small buffer, giving an attacker a clean memory-corruption foothold.
• CVE-2026-6688 (CVSS 7.6, High): Long filenames overflow the wrapper code many projects put around FatFs, such as a strcpy of fno.fname into a fixed buffer. Consequently, this is hard to fix inside FatFs alone.
• CVE-2026-6685 (CVSS 6.1, Medium): A math wrap in cache handling on fragmented volumes can silently corrupt data.
• CVE-2026-6683 (CVSS 4.6, Medium): An exFAT divide-by-zero crashes the device. Furthermore, in an update flow, it can brick hardware. Also reachable through some firmware updates.
• CVE-2026-6686 (CVSS 4.6, Medium): A file extended past its end can leak leftover data from previously deleted files.
• CVE-2026-6684 (CVSS 4.6, Medium): A malformed GPT partition table can hang the device during mount. Therefore, it is the only one of the seven fixed upstream, in FatFs R0.16.

AI-Assisted Discovery: A Growing Pattern

runZero first audited FatFs by hand in 2017 and found little worth reporting. Moreover, returning in March 2026, the team pointed an off-the-shelf AI pipeline at the same code: Visual Studio Code, GitHub Copilot in auto mode, and a few plain prompts.

The LLM built a fuzzer that fed malformed data into FatFs until something broke. Consequently, the AI pipeline surfaced bugs the manual audit had missed and helped confirm they were exploitable. This fits a growing pattern in which autonomous AI agents are uncovering vulnerabilities in widely embedded C libraries.

Business and Operational Impact

The FatFs vulnerabilities pose a unique risk because of the sheer breadth of affected devices. Furthermore, the library ships inside firmware that runs on real-time operating systems with limited memory protections, meaning any physical access can lead to a jailbreak.

• Massive device footprint: FatFs is bundled into Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate
• IoT and consumer exposure: Security cameras, smart TVs, drones, streaming boxes, and hardware crypto wallets may all be affected
• Industrial risk: Industrial controllers and public kiosks with USB or SD card slots are vulnerable to physical attacks
• Data leakage: CVE-2026-6686 can leak leftover data from previously deleted files, exposing sensitive information
• Brick risk: CVE-2026-6683 can permanently brick devices during firmware updates via a divide-by-zero crash
• No upstream fix: The lone maintainer has not responded to disclosure attempts, leaving vendors to patch independently

Mitigation and Recommendations

Organizations that build or deploy firmware using FatFs must act immediately. Therefore, defenders should audit their products and implement physical and logical controls.

Immediate Actions for Firmware Developers

1. Identify all copies of FatFs in your product and audit the wrapper code around it
2. Review how your firmware handles filenames and file sizes, especially for FAT32 and exFAT volumes
3. Apply the FatFs R0.16 update to mitigate CVE-2026-6684 (GPT partition table hang)
4. Patch the remaining six vulnerabilities independently since no upstream fix exists
5. Validate all storage media and firmware images before processing them

Immediate Actions for Device Operators

1. Treat physical ports (USB, SD card slots) as active attack surfaces
2. Restrict who can plug in media or insert storage devices
3. Watch for vendor firmware updates that address the FatFs flaws
4. Monitor devices for unexpected crashes, hangs, or data corruption
5. Consider disabling automatic mounting of untrusted storage media

Bottom line: Seven FatFs vulnerabilities expose millions of embedded devices to memory corruption and code execution. Also, the lack of an upstream fix and a single unresponsive maintainer make this a long-tail patching problem. Therefore, device manufacturers and operators must take responsibility for auditing and hardening their firmware.

Incident Summary

CVE IDs:	CVE-2026-6682, CVE-2026-6683, CVE-2026-6684, CVE-2026-6685, CVE-2026-6686, CVE-2026-6687, CVE-2026-6688
Affected Systems:	Embedded devices using FatFs — security cameras, drones, industrial controllers, crypto wallets, smart TVs, streaming boxes
Severity:	High (CVE-2026-6682, CVE-2026-6687, CVE-2026-6688); Medium (CVE-2026-6683, CVE-2026-6684, CVE-2026-6685, CVE-2026-6686)
Disclosure Date:	July 1, 2026
Patch Status:	CVE-2026-6684 fixed in FatFs R0.16; six other CVEs remain unpatched upstream
Exploitation:	No confirmed attacks reported; proof-of-concept exploit material publicly available
Attack Vector:	Malicious USB drives, SD cards, or firmware images on physical or network-accessible update channels
Affected Platforms:	Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, SWUpdate

References

1. runZero, “FatFs Bugs: Memory Corruption and Code Execution in Millions of Embedded Devices,” July 1, 2026, https://www.runzero.com/blog/fatfs-bugs/, accessed July 4, 2026.
2. runZero, vulns-2026-fatfs-chance GitHub repository (proof-of-concept and exploit examples), July 2026, https://github.com/runZeroInc/vulns-2026-fatfs-chance, accessed July 4, 2026.
3. Google Threat Intelligence Group, “Google’s AI Tool Big Sleep Finds Zero-Day in SQLite,” November 2024, https://thehackernews.com/2024/11/googles-ai-tool-big-sleep-finds-zero.html, accessed July 4, 2026.
4. CVE.org, CVE-2026-6682 Record, https://www.cve.org/CVERecord?id=CVE-2026-6682, accessed July 4, 2026.
5. ChaN (FatFs maintainer), FatFs — Generic FAT File System Module, elm-chan.org, https://elm-chan.org/fsw/ff/, accessed July 4, 2026.