Description
FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Published: 2026-07-01
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FatFs libraries prior to release R0.16 that are compiled with GPT scanning enabled (FF_LBA64 set to 1) use the GPT header field GPTH_PtNum as the loop counter during a mount operation. If that field contains an unusually large or corrupted value, the loop condition never becomes false, causing the mount routine to run indefinitely or for an extremely long time. The result is an availability loss: the storage device cannot be mounted and any file access is blocked. This issue matches CWE‑835, describing a loop with an unreachable exit condition.

Affected Systems

Embedded devices or firmware a pre‑R0.16 build of the ChaN FatFs library with GPT scanning enabled (FF_LBA64 set to 1) are impacted.

Risk and Exploitability

The CVSS v3.1ifies the vulnerability as Medium severity with a high availability impact. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an adversary would need physical access to a device containing a crafted GPT header; the loop condition then never becomes false during a mount operation, leading to an availability loss. No code execution or data compromise is involved.

Generated by OpenCVE AI on August 1, 2026 at 23:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest FatFs release R0.16 or newer, which resolves the GPT scan loop bug.
  • If an immediate upgrade is not feasible, disable GPT scanning by ensuring FF_LBA64 is set to 0 or remove GPT support from the build configuration.
  • Modify the code to add bounds checking on the GPTH_PtNum value or set a hard maximum partition count before using it as a loop counter.

Generated by OpenCVE AI on August 1, 2026 at 23:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Chan
Chan fatfs
Vendors & Products Chan
Chan fatfs

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Title FatFs Infinite Loop in GPT Partition Scan
Weaknesses CWE-835
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Chan Fatfs
Elm-chan Fatfs
cve-icon MITRE

Status: PUBLISHED

Assigner: runZero

Published:

Updated: 2026-07-01T15:25:53.071Z

Reserved: 2026-04-20T15:06:20.061Z

Link: CVE-2026-6684

cve-icon Vulnrichment

Updated: 2026-07-01T15:25:49.136Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-01T15:17:12.553

Modified: 2026-07-02T14:38:25.923

Link: CVE-2026-6684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:45:03Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')