- Published on
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
- Authors
- Name
- DeepHorus
Security firm runZero has disclosed seven vulnerabilities in FatFs, a small filesystem library used by millions of embedded devices to read FAT and exFAT formats on USB drives and SD cards. The flaws pose significant risks because FatFs is nearly ubiquitous, shipping inside firmware for security cameras, drones, industrial controllers, and hardware crypto wallets built on real-time operating systems. On the worst-affected systems, an attacker who inserts a booby-trapped USB drive or SD card can corrupt memory and execute arbitrary code, potentially gaining full control of the device. FatFs is maintained by a single developer, and runZero says it repeatedly tried to contact the maintainer—even looping in Japan's JPCERT/CC coordination center—with no response. As a result, there is no upstream fix for the memory-corruption bugs, no security mailing list, and no coordinated disclosure channel. Only one of the seven flaws (CVE-2026-6684, a malformed GPT partition table issue) has been patched in the latest FatFs release R0.16. The seven vulnerabilities range in severity from Medium to High, with no Critical ratings. The most severe is CVE-2026-6682 (CVSS 7.6), an integer overflow during FAT32 mount that can lead to memory corruption and code execution. Other highlights include CVE-2026-6687 (buffer overflow from exFAT volume labels) and CVE-2026-6688 (long filenames overflowing wrapper code). Medium-severity bugs include cache handling flaws, a divide-by-zero that can brick devices, and data leakage from extended file ends. runZero emphasizes that many embedded devices lack memory protections found on phones and desktops, meaning "any physical access leads to a jailbreak." This allows public kiosks, cameras with SD slots, ATMs, or voting machines with USB ports to be compromised with just a moment of physical access. Affected platforms include Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr, MicroPython, ArduPilot, and Samsung TizenRT, pushing the problem into consumer IoT, industrial gear, drones, and crypto wallets. As of runZero's July 1 disclosure, no attacks exploiting these bugs have been reported, but the exploit material is public. runZero shipped proof-of-concept disk images, a test harness, and a working QEMU-based exploit example. This shifts the burden to downstream vendors to patch their own implementations, as no upstream fixes exist for the critical memory-corruption flaws. For firmware builders, runZero advises finding the FatFs copy in products, auditing wrapper code, and reviewing handling of filenames and file sizes. Device operators should treat physical ports and update channels as an attack surface, limiting who can plug in media and monitoring for unusual activity. With no coordinated patch, the security of millions of devices now depends on individual vendor responses.
