FatFs versions R0.16 and earlier contain an integer underflow flaw caused by an unsigned subtraction wrap while evaluating (fp->sect - sect) in the f_read() and f_write() functions when performing interleaved read/write operations on a fragmented file system. This mismatch can cause the library or loss and may trigger application crashes or denial of service. The weakness maps to CWE-191 (Integer Underflow).

The vulnerable component is the ChaN FatFs library. All embedded projects, firmware, or applications that incorporate FatFs fragmented storage devices are affected. It is inferred that any system relying on FatFs for data persistence—such as board‑level firmware, microcontroller file system drivers, appliance software stacks, and other embedded software—could be impacted.

The CVSS v3.1 score of 6.1 denotes a medium severity vulnerability with a physical attack vector, low complexity, and no user interaction. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker underflow, leading to total data integrity and availability loss. The technical impact is considered total, but the need for physical presence makes widespread exploitation unlikely.