Seven FatFs Vulnerabilities Exposing Embedded Devices to Code Execution

Seven newly disclosed vulnerabilities in the ubiquitous FatFs library (CVE-2026-6682–CVE-2026-6688) can lead to integer and stack overflows, buffer/filename overflows, divide-by-zero, uninitialized-data leakage, and GPT mount-time DoS; these issues affect many embedded platforms (ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, SWUpdate) and can be triggered by malicious USB/SD media or booby-trapped firmware updates. runZero published PoC disk images, a test harness and a QEMU-based exploit, upstream fixes are limited (only the GPT DoS fixed in R0.16), and no active exploitation was reported at disclosure.