RunZero Exposes Seven Vulnerabilities in Widely Used FatFs Library

Security firm runZero disclosed a set of seven critical flaws affecting the FatFs library—a small, widely deployed filesystem engine that powers countless embedded devices including USB drives, SD cards, and industrial control panels.¹.uk]

The vulnerabilities range from privilege escalation to remote code execution, allowing attackers to read, modify, or delete data stored on affected media. Because FatFs underpins everything from camera memory cards to medical device storage, the scope of exposure could reach billions of devices worldwide.¹.uk]

RunZero’s analysis notes that FatFs originated during Minix OS development nearly forty years ago, chosen for its minimal footprint which keeps hardware costs low.¹.uk] That legacy design choice now translates into widespread supply‑chain risk; any vulnerability can propagate through layers of production, distribution, and deployment. Experts compare the potential impact to the Heartbleed OpenSSL breach, where a single flaw exposed every server running the internet at the time. Similarly, because FatFs is embedded in both consumer electronics and critical infrastructure components, a successful exploitation could compromise sensitive data streams or even operational controls.

From an operational perspective, organizations using affected media should conduct immediate inventory scans, verify device authenticity, and apply available patches or mitigations. For consumers, it remains unclear whether typical USB sticks or SD cards sold today contain patched versions, underscoring the need for vigilance when transferring files between devices. The runZero report also stresses that attackers may use these flaws to exfiltrate data from corporate networks via compromised removable storage—an attack vector that had previously been considered low risk.

Overall, the discovery of seven vulnerabilities in FatFs underscores how legacy software choices can create modern security nightmares. While remediation work is underway, the sheer scale of deployment means that both manufacturers and users must act swiftly to mitigate potential breaches across consumer and critical infrastructure sectors alike.