Mounting a FAT32 volume in FatFS R0.16 or earlier triggers an integer overflow in the mount_volume() function where the calculation fasize *= fs->n_fats can wrap, corrupting file‑size metadata. An attacker can this overflow, resulting in unsafe read lengths in later filesystem calls. The corrupted metadata can enable arbitrary memory reads or potentially lead to remote code execution if higher‑level processes misuse the value. This weakness is a classic example of CWE‑190 (Integer Overflow or Wraparound). Based on the description, potential remote code execution is inferred.

Systems that incorporate ChaN’s FatFs library version 0.16 or earlier and mount FAT32 volumes are affected. The vulnerability is present whenever the library performs the mount_volume() operation on a FAT32 volume. No specific operating system or device type is mandated; the issue relates solely to the FatFs library and its handling of FAT32 file‑size calculations.

The CVSS v3.1 score of 7.6 indicates high severity, but the EPSS score of less than  a very low probability of real‑world exploitation at present. The vulnerability is not listed in CISA KEV. Remote delivery via OTA or firmware pipelines that use FatFs is possible. Based on the description, the likely attack vector involves delivering a crafted FAT32 image through such update mechanisms or physically inserting a malicious volume when the device accesses a removable medium. Successful exploitation could compromise confidentiality, integrity, and availability and might enable remote code execution (inferred).