FatFs up to version 0.16 contains a stack buffer overflow in the f_getlabel() routine because the exFAT file system label length field (XDIR_NumLabel) is trusted without enforcing its maximum allowed size according to the exFAT specification. The flaw allows an attacker to supply a label longer than the stack buffer held by the routine, forcing an uncontrolled write that can corrupt adjacent stack data. If successfully exploited the overflow can lead to memory corruption, denial of service, or arbitrary code execution, which explains the CVSS v3.1 score of 7.6 classified as high severity.

The affected library is ChaN FatFs, the lightweight file system library widely used in embedded firmware, operating systems, and other resources constrained systems. All releases version 0.16 and earlier are affected. Devices that compile FatFs without addressing the flaw, or that omit the fix in the subsequent versions, remain vulnerable.

The EPSS score of less than 1% indicates a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 7.6 highlights a high potential impact. The flaw can be triggered by an attacker delivering a malicious exFAT volume that contains a label longer than the permitted size. When a device processes the label via the f_getlabel() routine, the unchecked length causes a stack overwrite that can corrupt adjacent memory, leading to denial of service, memory corruption, or potentially arbitrary code execution. A proof‑of‑concept is available, but no production exploit has been reported in the wild, so the risk remains theoretical at present.