FatFs Infinite Loop in GPT Partition Scan

Description

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

Scores

EPSS (exploitation in 30 days)

0.31% · top 77% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.

Weakness

• CWE-835 Loop with unreachable exit condition ('infinite loop') (opens in a new tab)All about CWE-835 and its CVEs

Affected products

• ChaN · FatFs

  • affected < R0.16

References (4)

• https://www.runzero.com/blog/fatfs-bugs/ (opens in a new tab)third-party-advisory
• https://github.com/runZeroInc/vulns-2026-fatfs-chance (opens in a new tab)technical-descriptionexploit
• https://elm-chan.org/fsw/ff/ (opens in a new tab)product
• https://www.runzero.com/advisories/fatfs-gpt-scan-loop-dos-cve-2026-6684/ (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-6684](https://trackcve.app/badge/CVE-2026-6684.svg)](https://trackcve.app/cve/CVE-2026-6684)

Record last updated 1 Jul 2026, 15:25 UTC.