Which CVEs affect FatFs r0.13?
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2026-6682 | high | 7.6 | not stated | per vulnerability databases |
| CVE-2026-6687 | high | 7.6 | not stated | per vulnerability databases |
| CVE-2026-6688 | high | 7.6 | not stated | per vulnerability databases |
| CVE-2026-6683 | medium | 4.6 | not stated | per vulnerability databases |
| CVE-2026-6684 | medium | 4.6 | r0.16 | per vulnerability databases |
| CVE-2026-6686 | medium | 4.6 | not stated | per vulnerability databases |
Which FatFs version do I need to upgrade to?
Fixed in FatFs r0.16: 1 CVE of this version.
No fix version stated: 5.
What changed against FatFs r0.12c?
No CVE of r0.12c dropped out in r0.13.
No CVE was added in r0.13.
What does the number mean for a device?
Counted are the CVEs public sources name for FatFs version r0.13 (NVD). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Questions
How many CVEs does FatFs r0.13 have?
As of 13 Nov 2026, 6 CVEs are known for FatFs r0.13, 0 critical and 3 high. r0.16, the newest listed version, still carries 5 of them.
From which version are the CVEs of FatFs r0.13 fixed?
No newer listed version is free of all 6 CVEs. The "Fixed from" column names the fix version per CVE for this release line where a source states one.
Sources
- [1]NVD