CVE-2026-6688

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

• CWE-120

• https://elm-chan.org/fsw/ff/Product
• https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit
• https://www.runzero.com/advisories/fatfs-long-fn-of-downstream-cve-2026-6688/Third Party Advisory
• https://www.runzero.com/blog/fatfs-bugs/Third Party Advisory, Exploit
• https://github.com/runZeroInc/vulns-2026-fatfs-chanceThird Party Advisory, Exploit

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66843Inclusion of Functionality from Untrusted Control Sphere vul…6.1
• CVE-2026-6685Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-6686FatFs R0.16 and earlier contains an uninitialized cluster ex…4.6
• CVE-2026-6687FatFs R0.16 and earlier contains a stack overflow bug in f_g…7.6
• CVE-2026-66875In the Mira hormone monitor device firmware v1.7.1.47 build …8.8
• CVE-2026-66878A flaw was found in multicloud-operators-subscription. A pri…7.7
• CVE-2026-66881Relative Path Traversal vulnerability in livebook-dev livebo…8.1
• CVE-2026-66883Improper Handling of Case Sensitivity vulnerability in Erlan…6.3
• CVE-2026-66884Cross-Site Request Forgery vulnerability in Erlang Ecosystem…2.1
• CVE-2026-66885Cross-Site Request Forgery (CSRF) vulnerability in livebook-…6.5
• CVE-2026-6689Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.1…4.3
• CVE-2026-6690The LifePress plugin for WordPress is vulnerable to Stored C…7.2