CVE-2026-6688

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier

Description An issue exists in the handling of long filenames when LFN (Long File Name) is enabled. The fno.fname variable can reach up to 255 characters, and many callers copy this data into short fixed buffers without performing bounds checks, leading to a buffer overflow. A buffer overflow occurs when a program writes more data to a block of memory than it is allocated to hold.

Recommendations Update FatFs to a version later than R0.16. Ensure that the size of the file name buffer is sufficient to hold up to 255 characters when copying fno.fname.