The vulnerability CVE-2026-6682 affects ChaN FatFs R0.16 and earlier. It is an integer overflow (CWE-190) in the mount_volume() function where the calculation fasize *= fs->n_fats can wrap around. This allows an attacker to manipulate file-size metadata and cause unsafe read lengths in downstream functions. The CVSS v3.1 score is 7.6 (High) with vector AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating remote exploitability with low attack complexity and no privileges or user interaction required. The vulnerability can be exploited remotely, including through OTA or update pipelines. The CISA SSVC assessment indicates proof-of-concept exploitation and total technical impact.

Successful exploitation can lead to attacker-controlled file-size metadata, resulting in unsafe read operations that compromise confidentiality, integrity, and availability of the system using the FatFs library. The vulnerability allows remote attackers to cause significant impact without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should monitor vendor communications for updates and consider mitigating exposure in OTA/update pipelines if possible.