Skip to content

Vendor

ChaN vulnerabilities

6 published CVES affecting ChaN, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
0
High
3
Medium
3
Low
0
Unscored
0
CISA KEV
0
Atom feed of ChaN alerts

Products

Latest ChaN CVEs

Newest publication first

  1. CVE-2026-6688 FatFs Buffer Overflow via Unbounded LFN Filename Copy

    Published
    HighCVSS 7.6

    FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CW...

  2. CVE-2026-6687 FatFs Stack Buffer Overflow via Uncapped exFAT Label Length

    Published
    HighCVSS 7.6

    FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:...

  3. CVE-2026-6686 FatFs Use of Uninitialized Clusters After Seek Past EOF

    Published
    MediumCVSS 4.6

    FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

  4. CVE-2026-6684 FatFs Infinite Loop in GPT Partition Scan

    Published
    MediumCVSS 4.6

    FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition)....

  5. CVE-2026-6683 FatFs Divide-by-Zero in exFAT Sync

    Published
    MediumCVSS 4.6

    FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Mediu...

  6. CVE-2026-6682 FatFs Integer Overflow in FAT32 Volume Mount

    Published
    HighCVSS 7.6

    In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimate...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.