CVE-2026-6686 FatFs Use of Uninitialized Clusters After Seek Past EOF
Attackers with physical access can read uninitialized memory from newly allocated clusters when extending files past EOF in FatFs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6686?
CVE-2026-6686 is a medium-severity vulnerability in ChaN FatFs, published on 1 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Weakness: CWE-908
Which versions are affected by CVE-2026-6686?
It affects 1 product.
Products include Elm-Chan Fatfs.
How do I fix CVE-2026-6686?
No fix has been published for CVE-2026-6686 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6686 exists.
Other vulnerabilities in ChaN FatFs
- CVE-2026-6682 FatFs Integer Overflow in FAT32 Volume Mount
- CVE-2026-6687 FatFs Stack Buffer Overflow via Uncapped exFAT Label Length
- CVE-2026-6688 FatFs Buffer Overflow via Unbounded LFN Filename Copy
- CVE-2026-6683 FatFs Divide-by-Zero in exFAT Sync
- CVE-2026-6684 FatFs Infinite Loop in GPT Partition Scan
Sources
Also known as GHSA-h94p-vjqx-v7rr.