CVE-2026-6687

PoC ×2—

CVSS 3.1

7.6 high

EPSS

<1%p28

Published

Jul 1, 2026 (Jul 1, 2026)

Modified

Jul 2, 2026

Description

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

Vendors: elm-chan
Products: fatfs
Weakness: CWE-121
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news3 stories

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

The Hacker NewsJul 6, 13:02 UTC · Jul 6, 2026Ransomware CVE-2026-48276 CVE-2026-48283 CVE-2026-48277+69 CVEs1

Seven Bugs in FatFs Put IoT and Embedded Devices at Risk

Security AffairsJul 6, 10:20 UTC · Jul 6, 2026Exploit / PoC CVE-2026-6682 CVE-2026-6683 CVE-2026-6687+4 CVEs

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

The Hacker NewsJul 3, 20:19 UTC · Jul 3, 2026Vulnerability CVE-2026-6682 CVE-2026-6687 CVE-2026-6688+4 CVEs1