CVE-2026-6684

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

• CWE-835

• https://elm-chan.org/fsw/ff/Product
• https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit
• https://www.runzero.com/advisories/fatfs-gpt-scan-loop-dos-cve-2026-6684/Third Party Advisory
• https://www.runzero.com/blog/fatfs-bugs/Third Party Advisory, Exploit
• https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66825Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-66829URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2026-6683FatFs R0.16 and earlier contains a divide-by-zero in exFAT s…4.6
• CVE-2026-66832When the Mira Android app opens in-app WebView content (e.g.…6.9
• CVE-2026-66838Improper Neutralization of Special Elements used in an SQL C…5.9
• CVE-2026-66839NetKids iMark, provided by Integrated Systems Technologies, …8.4
• CVE-2026-66843Inclusion of Functionality from Untrusted Control Sphere vul…6.1
• CVE-2026-6685Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-6686FatFs R0.16 and earlier contains an uninitialized cluster ex…4.6
• CVE-2026-6687FatFs R0.16 and earlier contains a stack overflow bug in f_g…7.6
• CVE-2026-66875In the Mira hormone monitor device firmware v1.7.1.47 build …8.8
• CVE-2026-66878A flaw was found in multicloud-operators-subscription. A pri…7.7