CVE-2026-129490 · Package
NO FIX YET
littlefs, an embedded flash filesystem library, has a type confusion bug in lfs_dir_traverse() when built with LFS_MIGRATE. A crafted littlefs v1 image makes migration read stack memory out of bounds, crashing the process.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only builds compiled with LFS_MIGRATE enabled that open untrusted littlefs v1 images are described as exposed; the sources do not say which products or versions ship that build. Teams that do not use the migration feature or only handle images they create can likely skip it.
Not affected if lfs-migrate-disabled, no-untrusted-v1-images
Who cares c, embedded, littlefs
Unknown from the sources.
No fix yet, per the sources.
littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that treats a stack lfs_diskoff struct as an lfs_attr array. Attackers can supply a crafted littlefs v1 image whose metadata is read as LFS_FROM_USERATTRS during migration, causing out-of-bounds stack reads and process crashes.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.