CVE-2026-6682 et al.: FatFs Filesystem — Memory Corruption & Code Execution (July 2026)

CVE-2026-6682 et al. — FatFs Filesystem

Seven high-severity vulnerabilities (CVE-2026-6682, CVE-2026-6687, CVE-2026-6688, CVE-2026-6685, CVE-2026-6683, CVE-2026-6686, CVE-2026-6684) have been disclosed in the FatFs filesystem library, which is embedded in millions of devices. These flaws permit memory corruption and arbitrary code execution if an attacker with physical access introduces a specially crafted FAT or exFAT volume or firmware. No upstream fixes exist; the risk remains until downstream vendors issue patches. No active exploitation reported, but public proof-of-concept code is available.

Attack Vector

Attackers require physical access to the device—via USB, SD card, or firmware update—to deliver a malformed FAT/exFAT filesystem image. The vulnerabilities are triggered during filesystem parsing, enabling memory corruption, silent data loss, device crashes, or full code execution. Attackers can leverage these flaws for persistent jailbreaks, device bricking, or loss of control, especially in scenarios where removable media or firmware updates are permitted. No remote vector is currently known, but any interface accepting untrusted filesystem media is at risk.

Who Is at Risk

Confirmed affected platforms include Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate. Impacted devices span security cameras, drones, industrial controllers, and hardware crypto wallets. Any embedded device using FatFs and accepting removable storage or firmware updates is vulnerable unless downstream patches are applied.

Patch & Mitigate

• Patch: No upstream FatFs patches are available as of July 2026. Downstream vendors must issue and deploy their own fixes. Monitor vendor advisories for updates.
• Workaround: Restrict or disable untrusted removable media and firmware updates. Enforce physical access controls. Where possible, validate filesystem images before mounting.
• Detect: Monitor for unexpected device reboots, filesystem errors, or unexplained data corruption after media insertion or firmware updates. Review logs for abnormal mount or update activity.

MITRE ATT&CK

• TA0005 — Defense Evasion: Attackers can bypass device integrity by exploiting filesystem parsing flaws.
• TA0007 — Discovery: Malformed media may be used to probe device handling of filesystems.
• TA0009 — Collection: Exploitation may allow attackers to extract or manipulate sensitive data stored on the device.

Source: https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html