In brief: A critical memory corruption bug in the FatFs driver enables remote code execution through crafted USB storage devices without user interaction.
A vulnerability in the widespread FatFs file system driver allows malicious code to be injected by simply connecting a USB stick to embedded and IoT devices. To date, no patch exists for this vulnerability.
FatFs is a widely-used file system driver for embedded systems and IoT devices. The newly discovered vulnerability allows attackers to execute arbitrary code with kernel privileges through a specially crafted USB storage device – simply connecting the stick is sufficient; no user action is required.
The vulnerability was identified through analysis using AI methods, after traditional static code analysis had missed it. This demonstrates that automated machine learning procedures are becoming increasingly important in the search for memory violations in legacy code – particularly in cases where manual code reviews reach their limits due to complexity and scope.
From a risk management perspective, the unavailability of a patch is critical: FatFs is deployed in numerous industrial controls, medical devices, and safety-critical systems. A centralized patching strategy is not immediately possible, as many of these systems run isolated long-term or are only updatable with significant effort. CISOs must promptly conduct a risk assessment and evaluate implementable mitigation measures such as access control on USB ports or network segmentation.
Source: www.golem.de · Published 3 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.2.