Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

Security firm runZero has disclosed seven vulnerabilities in FatFs, a small filesystem library that lets a device read and write the FAT and exFAT formats used on USB drives and SD cards. The flaws matter because FatFs is nearly everywhere. It ships inside the firmware that runs security cameras, drones, industrial controllers, hardware crypto wallets, and other devices built on

The article reports that security firm runZero disclosed seven vulnerabilities in the FatFs filesystem library (used for FAT/exFAT on USB/SD media) that is bundled into firmware for millions of embedded devices, including IoT, industrial controllers, drones, and crypto wallets.[2][3] These flaws can be triggered by crafted storage volumes or update images, leading to memory corruption, code execution, device crashes, data leakage, or bricking, and most issues remain unpatched upstream.[2][3] From a CyberSE.AI perspective, this illustrates a systemic software supply chain risk: AI-enabled or AI-adjacent embedded systems (e.g., edge/IoT devices feeding AI pipelines) may unknowingly inherit exploitable filesystem code, so organizations need SBOM-driven dependency discovery, vendor attestation, and compensating controls on removable media and OTA update paths. Security teams should incorporate these findings into AI security readiness, ensuring that AI workloads depending on such devices account for the integrity and trustworthiness of data and firmware coming from vulnerable endpoints.