FatFs long filename overflow in wrapper code
An overflow in FatFs's long-filename wrapper code can be triggered by a crafted filesystem entry. FatFs is embedded across many RTOS and firmware distributions. Disclosed by runZero on 2026-07-01 alongside six other FatFs CVEs; no upstream fix as of disclosure.
- Vendor
- ChaN / FatFs upstream
- Product
- FatFs (as shipped in downstream RTOS / firmware distributions)
- CVSS
- 7.6
- EPSS (exploit probability)
- 0.3%
- Status
- unpatched
- Published
An overflow in FatFs’s long-filename (LFN) wrapper code can be triggered by a specially crafted filesystem entry. The flaw affects the handling of long filenames in the FAT filesystem layer and can lead to memory corruption on the device parsing the volume.
Disclosed by runZero on July 1, 2026 as part of a seven-CVE FatFs disclosure, this flaw affects downstream distributions that include FatFs — ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, and SWUpdate. No upstream fix had been released as of disclosure.
Mitigation: Check your RTOS or firmware vendor’s security advisories for a backported fix. See runZero’s full disclosure for technical scope. Full coverage: FatFs — runZero Discloses Seven Embedded Firmware Flaws.
