CVE-2026-6687

CVSS 3.1: 7.6 high
EPSS: <1%p28
Published: Jul 1, 2026 · Jul 1, 2026
Modified: Oct 25, 2026

Analyze CVE-2026-6687 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

Vendors: elm-chan

Products: fatfs

Weakness: CWE-121

Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

3 stories

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

The Hacker NewsJul 6, 13:02 UTC · Jul 6, 2026RansomwareCVE-2026-48276 CVE-2026-48283 CVE-2026-48277+692

Seven Bugs in FatFs Put IoT and Embedded Devices at Risk

Security AffairsJul 6, 10:20 UTC · Jul 6, 2026Exploit / PoCCVE-2026-6682 CVE-2026-6683 CVE-2026-6687+43

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

The Hacker NewsJul 3, 20:19 UTC · Jul 3, 2026VulnerabilityCVE-2026-6682 CVE-2026-6687 CVE-2026-6688+45 · 2 reads