The vulnerability in ChaN FatFs (version R0.16 and earlier) involves the f_lseek() function failing to zero-fill newly allocated clusters when extending files beyond EOF. This leads to exposure of uninitialized clusters, which may contain residual data from previous file contents or memory. The issue is categorized under CWE-908 (Use of Uninitialized Resource). The CVSS v3.1 vector indicates the attack requires physical access (AV:P), has low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N/A:N). There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with physical access to the storage medium can exploit this vulnerability to read uninitialized data from newly allocated clusters when files are extended beyond EOF using f_lseek(). This can lead to disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability of the system or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious when using f_lseek() to extend files and consider implementing application-level zero-filling of newly allocated clusters as a temporary mitigation.