CVE-2026-6687

HIGH 7.6CVE-2026-6687 · Published 01/07/2026 · updated 25/10/2026

In short

CVE-2026-6687 is a HIGH (CVSS 7.6) vulnerability affecting fatfs (elm-chan).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
fatfs elm-chan	`≤ r0.16`	No fix yet

Description

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

References

elm-chan.org/fsw/ff · Product
runZeroInc/vulns-2026-fatfs-chance · Third Party Advisory
runzero.com/advisories/fatfs-exfat-label-len-of-cve-2026-6687 · Third Party Advisory
runzero.com/blog/fatfs-bugs · Third Party Advisory

More vulnerabilities in fatfs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fatfs

elm-chan

≤ r0.16

No fix yet

Description

More vulnerabilities in fatfs

See all →