Mounting a FAT32 volume in FatFs R0.16 or earlier triggers an integer overflow in the mount_volume() function where the calculation fasize *= fs->n_fats can wrap, corrupting file‑size metadata. The corrupted metadata permits unsafe read lengths in downstream filesystem calls, potentially allowing an attacker to read arbitrary memory or influence subsequent operations. Because the overflow influences lower‑level file handling, the flaw can enable remote code execution if higher‑level processes misuse the malicious values. This weakness is categorized as CWE‑190 (Integer Overflow or Wraparound). The high‑severity CVSS v3.1 score of 7.6 reflects the serious impact on confidentiality, integrity, and availability.

Systems that incorporate ChaN’s FatFs library version 0.16 or earlier and mount FAT32 volumes are affected. The vulnerability is present whenever the library performs the mount_volume() operation on a FAT32 volume. No specific operating system or device type is mandated; the issue relates solely to the FatFs library and its handling of FAT32 file‑size calculations.

The CVSS v3.1 score of 7.6 indicates high severity, while the EPSS score of less than a very low probability of real‑world exploitation at present suggests the risk is moderate at this time. The flaw is not listed in CISA KEV. Remote delivery via OTA or firmware pipelines that use FatFs is possible, as is physical insertion of a malicious volume when the device accesses a removable medium. If the overflow is leveraged, an attacker could compromise confidentiality, integrity, and availability and might enable remote code execution, although this would likely require higher‑level process exploitation.