Multiple FatFs Vulnerabilities Expose Millions of Embedded Devices to Cyber Risks

Cybersecuritynews •Guru Baran • July 4, 2026

Security researchers at runZero have disclosed seven new CVEs affecting FatFs, the ubiquitous lightweight FAT/exFAT filesystem driver used across embedded and IoT ecosystems. The vulnerabilities range from CVSS Medium to High, with no Critical-rated findings, but their reach is significant: FatFs underpins platforms including Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FatFs Vulnerabilities Enable Physical Access Attacks on Millions of Devices Security firm runZero has identified seven unpatched vulnerabilities in the FatFs filesystem driver, affecting millions of embedded devices. These vulnerabilities can be exploited through malicious media or firmware images, leading to memory corruption, denial of service, and potential code execution. Devices utilizing FatFs, which is widely adopted in industrial and IoT ecosystems, are at risk, including those based on various RTOS platforms. The vulnerabilities range from CVSS Medium to High severity, with no patches currently available. Exploitation requires physical access to the device, but some scenarios allow for remote exploitation via OTA updates. The vulnerabilities are cataloged as CVE-2026-8451 and CVE-2026-45659, with the latter being actively exploited. The lack of patches and the extensive use of FatFs across devices heighten the urgency for manufacturers to address these issues. 11 sources 67

Extracted Entities

Companies (1)

Samsung

Platforms (8)

ArduPilot Espressif Esp-idf FatFs Mbed MicroPython RT-Thread STMicroelectronics STM32Cube Zephyr RTOS