TI-2026-05864 Aliases CVE-2026-6684 GHSA-vhc7-qgwj-vx6v

FatFs Infinite Loop in GPT Partition Scan

MEDIUM 54CWE-835Published 2026-07-01 · Updated 2026-07-01

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00306 23rd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed FatFs (ChaN): R0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ChaN	FatFs	before R0.16	R0.16	Patch available	CNA

FatFs VendorChaN Affected before R0.16 Fixed in R0.16 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elm-chan:fatfs::::::::	before r0.16	Vulnerable	ChaN

cpe:2.3:a:elm-chan:fatfs:*:*:*:*:*:*:*:* Versions before r0.16 Vulnerable ·ChaN

Remediation

Fix · CNA FatFs (ChaN) Fixed in R0.16

Timeline

2026-10-02 Threatist record created from CVE-2026-6684
2026-10-03 Alias added: GHSA-vhc7-qgwj-vx6v

References

Exploit 2

Advisory 1

https://www.runzero.com/advisories/fatfs-gpt-scan-loop-dos-cve-2026-6684/

Other 1

https://elm-chan.org/fsw/ff/

TI-2026-05867 FatFs Buffer Overflow via Unbounded LFN Filename Copy CVSS 3.1HIGH 7.6
TI-2026-05866 FatFs Stack Buffer Overflow via Uncapped exFAT Label Length CVSS 3.1HIGH 7.6
TI-2026-05862 FatFs Integer Overflow in FAT32 Volume Mount CVSS 3.1HIGH 7.6
TI-2026-05865 FatFs Use of Uninitialized Clusters After Seek Past EOF CVSS 3.1MEDIUM 4.6
TI-2026-05863 FatFs Divide-by-Zero in exFAT Sync CVSS 3.1MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences