FatFs R0.16 has been released on July 22, 2025. These are the verified problems about FatFs R0.16 and its workaround or patch.
3. July 10, 2026 -------------------------------------------------------------------------------------------------- Some vulnerabilities in FatFs R0.16 and earlier have been found and published. Especially the second one and the third one might enable ACE if the memory card socket and the running program code is accesible. CVE-2026-6682 (*) A FAT BPB with broken FAT size field can collapse the files or lead a system crash. CVE-2026-6687 (*) An exFAT volume label with manipulated name length field can lead a buffer overflow. CVE-2026-6688 LFN length is 255 UTF-16 encode units maximum. Please make sure the size of buffer is sufficient to copy the read file name. CVE-2026-6685 Wraparound in these expressions is intentional and not harmful. CVE-2026-6683 (*) An exFAT BPB with manipulated cluster count field can trigger a /0 and lead the system crash. CVE-2026-6686 This behavior has been described in the manual. Please be careful. CVE-2026-6684 A manipulated table size field in GPT header can lead the system freeze. It does not cover FatFs R0.16. This publishment of problems was reported via an SNS. To fix these problems (*), apply patch-2 to ff.c with patch-1.
2. September 13, 2025 -------------------------------------------------------------------------------------------------- From a suggestion in user forum, I have changed the minimum volume size from 128 sectors to 64 sectors. This is the patch-1 for ff.c without patch. When create a volume on the very small drive with f_mkfs function, it is recommended to specify FM_SFD flag and set a proper value to n_root.
1. August 3, 2025 -------------------------------------------------------------------------------------------------- The Unicode conversion module, ffunicode.c, linked at LFN configuration occupies a large amount of memory when it is configured for DBCS. From a suggestion in user forum, I have found that there is much room for improvement of the compression ratio of 6 out of 8 conversion tables. This is the result in table size by modification of compression algorithm. Japanese (932) 59k ==> 47k (-12k) Simplified Chinese (936) 174k ==> 97k (-77k) Korean (949) 136k ==> 103k (-33k) Traditional Chinese (950) 108k ==> 78k (-30k) All CP (0) 482k ==> 329k (-153k) This is the new code for replacement. Note that there is no improvement for SBCS configurations.