A Tiny, Barely-Maintained Piece of Code Is Quietly Running Inside Millions of Devices — And It Has Unpatched Bugs

Security firm runZero just disclosed seven vulnerabilities in something almost nobody's heard of but nearly everything runs on: FatFs, a small piece of code that lets devices read and write USB drives and SD cards. It's baked into the firmware behind security cameras, drones, industrial equipment, hardware crypto wallets, and a long list of other gadgets built on lightweight operating systems.

Here's the part that actually matters to non-engineers: on the worst-affected devices, plugging in a booby-trapped USB stick or SD card can let an attacker take full control. Many embedded devices skip the memory protections your phone or laptop has, so — as runZero bluntly put it — "any physical access leads to a jailbreak." Think about that in context: a public kiosk, an ATM, a camera with an SD card slot, even a voting machine with a USB port. None of those should hand over full control just because someone plugged something in. Right now, some of them can.

The worst of the seven bugs is a flaw in how the code mounts FAT32 drives, rated 7.6 out of 10 in severity. Bad math inside FatFs can trick the system into misreading a file's size, which can spiral into memory corruption and let an attacker run their own code. A few of the others are similar corruption bugs; a couple just crash or "brick" the device; one quietly leaks leftover data from previously deleted files.

The real problem isn't the bugs themselves — it's that almost none of them have a real fix. FatFs is maintained by a single developer, and runZero says it tried repeatedly to reach that person, even looping in Japan's official security coordination center, and got no response. There's no security mailing list, no patch pipeline, no way for the countless companies quietly using this code to even find out they're affected. Only one of the seven bugs — a partition-table issue that can hang a device — has actually been fixed in the current release. The rest are stuck waiting on individual manufacturers to notice and patch on their own, which historically takes years, not weeks.

That list of manufacturers is long and touches everyday tech more than most people realize — chip and hardware platforms from Espressif, STMicroelectronics, Samsung, and others, plus widely used software frameworks like Zephyr and MicroPython. In practice, that means the fix has to happen product by product, brand by brand, with no central authority pushing it along.

As of now, there's no evidence anyone has actually exploited these bugs in the wild. But that's not necessarily reassuring — runZero has already published working proof-of-concept code showing exactly how the attack works, so the blueprint is out there for anyone who wants to try.

There's also a quietly interesting detail buried in how these bugs were even found: researchers ran an AI coding assistant against code that had already been manually audited back in 2017 and turned up clean. This time, the AI built its own tool to hammer the code with malformed data until it broke — and it found real, exploitable flaws the human review had missed years earlier. It's part of a pattern showing up across the industry lately, where AI tools are increasingly finding serious security bugs that slipped past traditional methods.

For now, the practical advice is simple: if you make or run devices that read USB drives or SD cards, don't assume they're safe just because they've always worked fine. And for everyone else, it's a reminder that a lot of the everyday tech around us runs on a patchwork of small, unglamorous code that nobody's really watching.