Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

runZero disclosed seven vulnerabilities in FatFs, a ubiquitous FAT/exFAT filesystem library used in embedded devices (cameras, drones, IoT, crypto wallets, etc.). Several high-severity bugs (notably CVE-2026-6682) can produce memory corruption and potential code execution via malicious USB/SD media or crafted firmware images; proof-of-concept exploits and test harnesses are public. The project appears to have an unresponsive maintainer, leaving downstream vendors responsible for fixes; no active exploitation was reported at disclosure.