FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->sect - sect < cc) during interleaved read/write on fragmented filesystems. This ma…
Summary
FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->sect - sect < cc) during interleaved read/write on fragmented filesystems. This maps to CWE-191 (Integer Underflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total. Note that this issue has been disputed by the Supplier. It will be rejected shortly.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (3)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://elm-chan.org/fsw/ff/ -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.runzero.com/advisories/fatfs-unsigned-sub-wrap-cve-2026-6685/ -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.runzero.com/blog/fatfs-bugs/
Sources
- NVD DATABASE
Original Links
- https://elm-chan.org/fsw/ff/ Product
- https://github.com/runZeroInc/vulns-2026-fatfs-chance Exploit
- https://www.runzero.com/advisories/fatfs-unsigned-sub-wrap-cve-2026-6685/ Third Party Advisory
- https://www.runzero.com/blog/fatfs-bugs/ Exploit
Timeline
- nvd_ingest NVD