The FatFs file system library routine to extend a file past its current end‑of‑file without zero‑initializing the newly allocated clusters. When those clusters are later read, they can contain residual data from other parts of the device’s storage, exposing confidential information. This flaw is identified as a use‑of‑uninitialized resource vulnerability (CWE‑908) and can lead to a confidentiality breach while having no direct impact on data integrity or availability.

Systems that incorporate the ChaN FatFs library in release R0.16 or earlier are affected. Embedded devices, firmware stacks, or host applications that use FatFs to manage flash or SD‑card storage and perform file growth via the f_lseek() function fall within the impact scope. Devices employing newer releases or that do not dynamically extend files are not impacted.

The CVSS v3.1 score of 4.6 signals a medium severity risk. The EPSS score is less than 1%, indicating a low probability of public exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker with control over the firmware or host application could invoke f_lseek() to expand a file and then read from the newly allocated region, thereby retrieving stale data.