Cyber Resilience

CVE-2026-6688

Memory Safety in Elm-Chan Fatfs ≤ r0.16

Public PoCMemory Safety
Published
01 July 2026
Modified
02 July 2026
Patch / advisory
CVSS Score v3.1 7.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0043 35th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-6688 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Elm-Chan Fatfs. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and CM-7 (Least Functionality) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps…

more

to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Buffer overflow (CWE-120) in FatFs LFN handling directly enables local exploitation for privilege escalation on affected systems.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Buffer overflow in FatFs LFN handling directly enables memory corruption for privilege escalation via crafted filesystem input.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-6687Same product: Elm-Chan Fatfs
CVE-2026-6682Same product: Elm-Chan Fatfs
CVE-2026-6684Same product: Elm-Chan Fatfs
CVE-2026-6686Same product: Elm-Chan Fatfs
CVE-2026-6683Same product: Elm-Chan Fatfs
CVE-2018-25314Shared CWE-120
CVE-2026-43750Shared CWE-120
CVE-2025-29481Shared CWE-120
CVE-2026-0849Shared CWE-120
CVE-2025-48611Shared CWE-120

Affected Assets

elm-chan
fatfs
≤ r0.16

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • CM-7 Least Functionality
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.2.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires bounds checking and size validation on untrusted input such as fno.fname before any copy into fixed buffers.

prevent

Allows disabling the LFN feature entirely when it is not required, eliminating the oversized fname source.

prevent

Provides memory-protection mechanisms that can contain or block exploitation of the resulting buffer overflow.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure development practices directly enforce bounds checking and input validation that prevent classic buffer overflows.

ID.RA-01 partial match
prevents

Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding directly requires bounds-checked memory operations, addressing the root cause of CWE-120.

detects

Security testing in development and acceptance can detect buffer overflows through fuzzing and static analysis, though it does not prevent them at the source.

prevents

Secure development life cycle mandates processes that can include input validation and bounds checking to prevent buffer overflows.

prevents

Application security requirements can specify input-size validation and safe buffer handling to mitigate classic buffer overflows.

prevents

Secure system architecture and engineering principles promote defensive coding patterns that reduce the likelihood of unchecked buffer copies.

References