CVE-2026-6686

FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

• CWE-908

• https://elm-chan.org/fsw/ff/Product
• https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit
• https://www.runzero.com/advisories/fatfs-uninit-cluster-exposure-cve-2026-6686/Third Party Advisory
• https://www.runzero.com/blog/fatfs-bugs/Third Party Advisory, Exploit
• https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66832When the Mira Android app opens in-app WebView content (e.g.…6.9
• CVE-2026-66838Improper Neutralization of Special Elements used in an SQL C…5.9
• CVE-2026-66839NetKids iMark, provided by Integrated Systems Technologies, …8.4
• CVE-2026-6684FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = …4.6
• CVE-2026-66843Inclusion of Functionality from Untrusted Control Sphere vul…6.1
• CVE-2026-6685Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-6687FatFs R0.16 and earlier contains a stack overflow bug in f_g…7.6
• CVE-2026-66875In the Mira hormone monitor device firmware v1.7.1.47 build …8.8
• CVE-2026-66878A flaw was found in multicloud-operators-subscription. A pri…7.7
• CVE-2026-6688FatFs R0.16 and earlier contains a downstream-caller vulnera…7.6
• CVE-2026-66881Relative Path Traversal vulnerability in livebook-dev livebo…8.1
• CVE-2026-66883Improper Handling of Case Sensitivity vulnerability in Erlan…6.3