ChaN FatFs versions R0.16 and earlier contain an integer underflow vulnerability in the f_read() and f_write() functions. The issue arises from an unsigned subtraction wraparound condition (fp->sect - sect < cc) during interleaved read/write operations on fragmented filesystems, which leads to stale dirty-cache skipping. This vulnerability maps to CWE-191 (Integer Underflow). The CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H with a score of 6.1, indicating a medium severity vulnerability with partial impact on integrity and availability but no confidentiality impact. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

The vulnerability can cause integrity and availability impacts by skipping stale dirty-cache data during file read/write operations on fragmented filesystems. Confidentiality is not affected. The medium CVSS score reflects the potential for data corruption or loss but does not indicate remote exploitation without physical or local access (AV:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding interleaved read/write operations on fragmented filesystems with affected versions or implement additional integrity checks at the application level.