The vulnerability appears in FatFs R0.16 when LFN support is enabled. The LFN field can contain up to 255 characters, but many callers copy it into a fixed short buffer without performing bounds checks, producing a classic buffer overflow (CWE‑120). Overwriting adjacent memory can corrupt data, subvert program flow, and potentially allow an attacker to compromise the confidentiality, integrity, and availability of the system that uses the library.

ChaN:FatFs is the vendor, and any embedded system, firmware, or downstream application that compiles FatFs R0.16 or earlier with LFN support is at risk and susceptible to exploitation.

The CVSS vector AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 7.6 score, indicating high severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely providing a maliciously long filename; exploitation requires control over file operations that use the vulnerable copy path, and a proof‑of‑concept has been demonstrated. The potential impact on confidentiality, integrity, and availability remains high if the overflow is triggered.