FatFs Flaws Put Cryptocurrency Wallet Security at Risk

FatFs is a general-purpose FAT/exFAT file-system module for small embedded systems and is commonly integrated into USB flash drives, SD cards, Internet of Things devices, industrial controllers, drones and hardware cryptocurrency wallets. Because the same underlying component is used across brands and devices, its vulnerabilities could create supply-chain risks, jeopardizing wallet data and control of affected devices.

Cybersecurity company runZero disclosed seven FatFs vulnerabilities in early July 2026. CVE-2026-6682, CVE-2026-6687 and CVE-2026-6688 were each rated high severity with CVSS scores of 7.6, while the other four scored between 4.6 and 6.1. Products including cryptocurrency wallets are affected. As of July 6, no confirmed exploitation or losses had been disclosed, and users of affected devices were still awaiting vendors' confirmation of patching progress.