Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

Summary: Security firm runZero disclosed seven vulnerabilities in FatFs, a small filesystem library bundled in firmware for security cameras, drones, industrial controllers, and hardware crypto wallets, with the worst allowing memory corruption and code execution when a device reads a malformed USB drive, SD card, or update file. The headline bug is CVE-2026-6682 (CVSS 7.6), an integer overflow in FAT32 volume mounting, and runZero says repeated attempts to reach the sole maintainer, including through Japan's JPCERT/CC, went unanswered, leaving no upstream fix.
What's compelling: There is no security mailing list and no responsive upstream, so the many products bundling FatFs - Espressif ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, and others - have no channel to learn they are affected, and runZero expects downstream fixes to take years. Proof-of-concept disk images, a test harness, and a working QEMU exploit are already public, so anyone with a USB port and a moment of physical access is working against code that has no fix behind it.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-6682
Related: ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026