Description
FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Published: 2026-07-01
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FatFs libraries older than release R0.16 that are compiled with GPT scanning enabled use the GPT header field GPTH_PtNum as the counter for a file system mount loop. If that field contains an unusually large or corrupted value the loop condition never becomes false, causing the mount routine to run indefinitely. The result is an availability loss: the storage device cannot be mounted and any application that relies on file access is blocked. The flaw matches CWE‑835, describing a loop with an unreachable exit condition.

Affected Systems

Embedded devices or firmware that include a pre‑R0.16 build of the ChaN FatFs library with the FF_LBA removable are impacted.

Risk and Exploitability

The CVSS v3.1 score of 4.6 classifies the vulnerability as Medium severity with a high availability impact. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in physical access to the target device, enabling an adversary to supply a storage medium containing a crafted GPT header that triggers the infinite loop. Code execution or data compromise is not involved.

Generated by OpenCVE AI on July 21, 2026 at 14:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the FatFs library to release R0.16 or later to eliminate the unbounded loop
  • If an upgrade is not possible, set the FF_LBA64 configuration flag to 0 to disable GPT scanning, preventing the loop from being entered
  • Implement a timeout or watchdog that detects and aborts a hung mount operation, or otherwise restrict mounting of GPT‑partitioned devices

Generated by OpenCVE AI on July 21, 2026 at 14:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Chan
Chan fatfs
Vendors & Products Chan
Chan fatfs

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Title FatFs Infinite Loop in GPT Partition Scan
Weaknesses CWE-835
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Chan Fatfs
cve-icon MITRE

Status: PUBLISHED

Assigner: runZero

Published:

Updated: 2026-07-01T15:25:53.071Z

Reserved: 2026-04-20T15:06:20.061Z

Link: CVE-2026-6684

cve-icon Vulnrichment

Updated: 2026-07-01T15:25:49.136Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:45:02Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')