Back Feeds.4Sysops

Seven unpatched FatFs vulnerabilities expose millions of embedded devices

Feeds.4Sysops •IT News • July 4, 2026

Security firm runZero has disclosed seven vulnerabilities in FatFs, a widely used filesystem library that enables devices to read and write FAT and exFAT formats on USB drives and SD cards. The flaws affect FAT, exFAT, and GPT parsing, and they can be triggered by malicious media or mounted firmware images. Exploitation can lead to memory corruption, denial of service, information disclosure, silent data corruption, and potential code execution. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FatFs Vulnerabilities Enable Physical Access Attacks on Millions of Devices Security firm runZero has identified seven unpatched vulnerabilities in the FatFs filesystem driver, affecting millions of embedded devices. These vulnerabilities can be exploited through malicious media or firmware images, leading to memory corruption, denial of service, and potential code execution. Devices utilizing FatFs, which is widely adopted in industrial and IoT ecosystems, are at risk, including those based on various RTOS platforms. The vulnerabilities range from CVSS Medium to High severity, with no patches currently available. Exploitation requires physical access to the device, but some scenarios allow for remote exploitation via OTA updates. The vulnerabilities are cataloged as CVE-2026-8451 and CVE-2026-45659, with the latter being actively exploited. The lack of patches and the extensive use of FatFs across devices heighten the urgency for manufacturers to address these issues. 11 sources 67

Extracted Entities

Seven unpatched FatFs vulnerabilities expose millions of embedded devices

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

Platforms (1)