{"id":"CVE-2026-91041","kind":"vulnerability","aliases":["CVE-2026-91041"],"related":[],"title":"FAT filesystem log replay heap overflow gives instruction pointer control","description":"Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.","summary":"FileX fault-tolerant log replay (_fx_fault_tolerant_apply_logs) bounds the on-disk offset and size against the whole sector cache instead of one sector. A crafted FAT image therefore gets an out-of-bounds write that can overwrite the fx_media_driver_entry callback, which is called on the next line. On targets without an MMU, ASLR or W^X this gives code execution. A second, lesser bug is an out-of-bounds read of total_size when the log loads. Fixed in 6.5.2.202603.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"filex","fixed":["6.5.2.202603"],"affected":"<= 6.5.1.202602","ecosystem":"vendor"}],"ecosystems":[],"tags":["eclipse-threadx","embedded","fat","filesystem","filex","fx-media","infrastructure","removable-media","rtos","threadx"],"not_affected_if":["fault-tolerance-not-enabled","no-fault-tolerant","trusted-media-only"],"how_to_check":"You are exposed if your firmware links FileX <= 6.5.1.202602 (check the FileX version string or your vendored source), is built with FX_ENABLE_FAULT_TOLERANT, and calls fx_fault_tolerant_enable() at runtime. Without either of those, no log is replayed and you are not affected.","fix":"Upgrade FileX (Eclipse ThreadX) to 6.5.2.202603 or later. The fix bounds the log copy against fx_media_bytes_per_sector and validates total_size before the checksum path. Workaround: build without FX_ENABLE_FAULT_TOLERANT, or do not call fx_fault_tolerant_enable(), on products that mount media they do not control.","status":"resolved","published_at":"2026-10-20T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:10:05+00:00","updated_at":"2026-10-25T03:31:23+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-25T03:10:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"FAT filesystem log replay heap overflow gives instruction pointer control","impact":"high","summary":"Mounting an attacker-controlled FAT image with fault tolerance enabled triggers an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on common embedded memory layouts it can overwrite the FX_MEDIA driver callback to take control of the instruction pointer.","category":"infrastructure","nicknames":[],"who_cares":["embedded","filesystem","fat","fx-media"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker gets code execution via mounted FAT image","analyst_note":"Sources give no affected product, versions or fix; check the NVD entry and the vendor advisory for the FileX/FX_MEDIA component to confirm scope and patch version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000527,"input_tokens":3324,"output_tokens":389,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected product, versions or fix; check the NVD entry and the vendor advisory for the FileX/FX_MEDIA component to confirm scope and patch version.","search":"'-2026':12A,15A '-91041':13A,16A '6.5.2.202603':123B 'appli':43B 'aslr':95B 'attack':127C,150C,154C 'attacker-control':126C 'attacker-posit':149C 'attacker-valu':153C 'bound':45B,72B,112B,140C 'bug':106B 'cach':57B 'call':85B 'callback':82B,169C 'caus':135C 'code':101B 'common':159C 'control':10A,128C,171C 'craft':63B 'cve':11A,14A 'disk':49B 'driver':80B,168C 'eclips':19B 'eclipse-threadx':18B 'embed':21B,160C 'enabl':134C 'entri':81B 'execut':102B 'fat':1A,22B,64B,129C 'fault':36B,41B,132C 'fault-toler':35B 'filesystem':2A,23B 'filex':17A,24B,34B 'fix':121B 'fx':26B,40B,78B,166C 'fx-media':25B 'get':67B 'give':7A,100B,170C 'heap':5A,141C 'imag':65B,130C 'infrastructur':28B 'instead':58B 'instruct':8A,174C 'layout':162C 'lesser':105B 'line':89B 'load':120B 'log':3A,38B,44B,119B,144C 'media':27B,31B,79B,167C 'memori':161C 'mmu':94B 'mount':124C 'next':88B 'offset':50B 'on-disk':47B 'one':60B 'out-of-bound':69B,109B,137C 'overflow':6A 'overwrit':76B 'pointer':9A,175C 'posit':151C 'reach':164C 'read':113B 'remov':30B 'removable-media':29B 'replay':4A,39B,145C 'rtos':32B 'second':104B 'sector':56B,61B 'size':52B,116B 'target':91B 'therefor':66B 'threadx':20B,33B 'toler':37B,42B,133C 'total':115B 'valu':155C 'w':97B 'whole':55B 'without':92B 'write':73B,142C,147C 'x':98B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-25T03:31:23Z","by":"analyst","run_id":734},"products":{"at":"2026-10-25T03:31:23Z","by":"analyst","run_id":734},"workarounds":{"at":"2026-10-25T03:31:23Z","by":"analyst","run_id":734},"how_to_check":{"at":"2026-10-25T03:31:23Z","by":"analyst","run_id":734},"who_affected":{"at":"2026-10-25T03:31:23Z","by":"analyst","run_id":734}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91041","severity":null,"published_at":"2026-10-20T14:17:04+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91041:734","url":null,"severity":null,"published_at":"2026-10-25T03:31:23+00:00","modified_at":"2026-10-25T03:31:23+00:00","first_seen_at":"2026-10-25T03:31:23+00:00","fetched_at":"2026-10-25T03:31:23+00:00","note":"Read maintainer advisory GHSA-c8cj-fj9j-426v and v6.5.2.202603 release notes: affects FileX <=6.5.1.202602 (release notes: 6.0.1 onward), fixed 6.5.2.202603. No exploitation or public PoC found (VulDB says none); no social search run."}],"documents":[{"id":3208,"url":"https://github.com/eclipse-threadx/filex/security/advisories/GHSA-c8cj-fj9j-426v","title":"FileX GHSA-c8cj-fj9j-426v","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3211,"url":"https://newreleases.io/project/github/eclipse-threadx/filex/release/v6.5.2.202603_rel","title":"FileX v6.5.2.202603 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}