CVE-2026-6684

MEDIUM 4.6

FatFs Infinite Loop in GPT Partition Scan

CVSS Score

4.6

EPSS Score

0.0%

EPSS Percentile

0th

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

CWE	CWE-835
Vendor	chan
Product	fatfs
Published	Jul 1, 2026
Last Updated	Jul 1, 2026

Stay Ahead of the Next One

Get instant alerts for chan fatfs

Be the first to know when new medium vulnerabilities affecting chan fatfs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

ChaN / FatFs

0 < R0.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

runzero.com: https://www.runzero.com/blog/fatfs-bugs/ github.com: https://github.com/runZeroInc/vulns-2026-fatfs-chance elm-chan.org: https://elm-chan.org/fsw/ff/ runzero.com: https://www.runzero.com/advisories/fatfs-gpt-scan-loop-dos-cve-2026-6684/

Credits

HD Moore of runZero, Inc. Tod Beardsley of runZero, Inc.