CVE-2026-6685

✕ Withdrawn — historical dataMEDIUMPre-NVD 6.1
6.1CVSS

FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->sect - sect < cc) during interleaved read/write on fragmented filesystems. This maps to CWE-191 (Integer Underflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

Note that this issue has been disputed by the Supplier. It will be rejected shortly.

CVSS v3
6.1
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

July 1, 2026

Last Modified

July 16, 2026

References (4)

Frequently asked(4)

What is CVE-2026-6685?
CVE-2026-6685 is a rejected CVE ID: its record was withdrawn on July 16, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority following a notification that the vulnerability determination was made in error. After review, the CNA confirmed the erroneous finding. Thanks to David Brown for reaching out about this issue.
When was the CVE record for CVE-2026-6685 published?
The CVE record for CVE-2026-6685 was published on July 1, 2026. EchelonGraph's copy of the record carries a last-modified date of July 16, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-6685?
CVE-2026-6685 has a CVSS base score of 6.1 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-6685?
There is nothing to remediate under CVE-2026-6685: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.