Ethical Hacking News
Seven critical bugs were discovered in the FatFs filesystem, which has far-reaching implications for IoT and embedded devices. These vulnerabilities have varying severity ratings and can cause memory corruption, crashes, or data leaks. The discovery of these bugs highlights the importance of disclosure and coordination in addressing security risks.
The discovery of seven bugs in FatFs filesystem by runZero highlights the risks to IoT and embedded devices. The bugs affect multiple platforms and have varying severity ratings, ranging from Medium to High. The vulnerabilities can cause memory corruption, crashes, or data leaks when reading crafted storage volumes or firmware images. RunZero stresses the importance of disclosure and coordination in addressing these vulnerabilities. Patch planning is essential for shipping or running affected products, particularly handling filenames and file sizes.
The discovery of seven bugs in the FatFs filesystem by runZero has highlighted the risks to the Internet of Things (IoT) and embedded devices. FatFs is a compact open-source library that allows embedded devices to read and write FAT and exFAT formatted storage, commonly used on USB drives and SD cards.
According to the report, these bugs were discovered using AI-powered tools, which greatly increased the efficiency of the testing process. The seven vulnerabilities have varying severity ratings, ranging from CVSS Medium to High, and affect multiple platforms including Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate.
These bugs can cause memory corruption, crashes, or data leaks when a device reads a crafted storage volume or firmware image. Two of the CVEs are also implicated in over-the-air firmware update processes, which extends the attack surface beyond physical media entirely.
The report highlights the challenges posed by FatFs due to its compact nature and widespread use across various devices. The lack of memory protections on many devices makes them vulnerable to jailbreaking, especially when address space layout randomization (ASLR) is not implemented.
In light of this discovery, runZero stresses the importance of disclosure and coordination in addressing these vulnerabilities. The firm emphasizes that keeping these bugs quiet would be unhelpful, as the tooling used to discover them is now widely available.
The broader point runZero makes is worth sitting with. Keeping these bugs quiet in 2026 would accomplish nothing, because the tooling that found them is now widely available. The right response to that reality is disclosure, coordination where possible, and publication to give defenders a head start.
runZero published proof-of-concept disk images, a test harness, and a working QEMU-based exploit demonstration in a companion repository at github.com/runZeroInc/vulns-2026-fatfs-chance. No attacks using these bugs had been reported as of the July 1 disclosure date.
Therefore, if you ship or run affected products, it is essential to find your vendored copy of FatFs, audit the wrapper code around it, examine how your code handles filenames and file sizes, and plan for patching. Pay particular attention to any code that copies fno.fname into a fixed-size buffer. If you run affected devices rather than build them, treat physical ports and firmware update channels as attack surfaces: restrict who can plug in media, monitor for vendor security advisories, and apply firmware updates when vendors release them.
Related Information:
https://www.ethicalhackingnews.com/articles/Seven-Flaws-in-FatFs-Put-the-Internet-of-Things-and-Embedded-Devices-at-Risk-ehn.shtml
https://securityaffairs.com/194808/security/seven-bugs-in-fatfs-put-iot-and-embedded-devices-at-risk.html
https://diamatix.com/fatfs-vulnerabilities-embedded-iot-firmware-risk/
Published: Mon Jul 6 06:17:58 2026 by llama3.2 3B Q4_K_M
