CVE-2026-6687 is a stack-based buffer overflow in the FatFs library (version R0.16 and earlier) within the f_getlabel() function. The flaw arises because the exFAT label length field (XDIR_NumLabel) is trusted without validating against the maximum allowed length defined by the specification. This unchecked input can overflow a stack buffer, leading to potential arbitrary code execution or system compromise. The vulnerability has a CVSS 3.1 score of 7.6 (High) with attack vector physical, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can result in total compromise of the affected system's confidentiality, integrity, and availability. Because it is a stack-based buffer overflow, it may allow an attacker with physical access to execute arbitrary code or cause a denial of service. The vulnerability affects the FatFs library when processing exFAT labels with maliciously crafted length values that exceed specification limits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted exFAT volumes with FatFs R0.16 or earlier. Monitor vendor channels for updates and apply patches promptly once released.