CVE-2026-6687

HighCVSS 7.6

Published: 01/07/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile — higher than 11% of all known CVEs

Summary

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums.

Risk Assessment

An attacker with physical access can exploit this vulnerability to execute arbitrary code or cause a denial of service, potentially leading to full system compromise.

Recommendation

Immediately update FatFs to a version later than R0.16 that includes a fix for this bug. If an update is not possible, restrict physical access to systems using this library.

Original NVD description (English source)

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.