← Back

CVE-2026-6688

nvd nist
Published: Jul 1, 2026Modified: Jul 2, 2026

JSON object

Loading...
7.6
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 6.0
Source: 44488dab-36db-4358-99f9-bc116477f914 (Secondary)

Description

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

Affected (1)

Products: Elm Chan: Fatfs
Elm Chan
1 product
Fatfs
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Fatfs
Up to r0.16

Related CWEs

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (5)

Source: 44488dab-36db-4358-99f9-bc116477f914
Product
Source: 44488dab-36db-4358-99f9-bc116477f914
Third Party AdvisoryExploit
Source: 44488dab-36db-4358-99f9-bc116477f914
Third Party Advisory
Source: 44488dab-36db-4358-99f9-bc116477f914
Third Party AdvisoryExploit
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party AdvisoryExploit

Timeline

No history available yet.