The vulnerability in ChaN FatFs R0.16 and earlier arises from improper handling of long filenames. Specifically, with LFN enabled, the fno.fname field can hold filenames up to 255 characters, but many functions downstream copy this data into smaller fixed buffers without verifying the size, causing buffer overflow conditions. This is a classic instance of CWE-120. The CVSS v3.1 base score is 7.6 (High), with attack vector being physical (AV:P), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope changed (S:C), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The CISA SSVC assessment indicates proof-of-concept exploitation exists and the technical impact is total compromise.

Successful exploitation can lead to total compromise of the affected system, including full confidentiality, integrity, and availability loss. The buffer overflow can allow attackers to execute arbitrary code or cause denial of service. The vulnerability requires physical access to the device (AV:P) but no privileges or user interaction, making it a significant risk in environments where physical access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor for vendor updates and apply patches once available. Until then, limiting physical access to affected devices may reduce risk.