CVE-2026-91041: FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FXMEDIA driver callback, giving control of the instruction pointer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using FileX are exposed when fault tolerance is enabled and they mount FAT images controlled by an attacker. The issue occurs during fault-tolerant log replay while mounting the image.
What does an attacker need to trigger the issue?
The attacker needs to provide a crafted FAT image and have it mounted by the affected FileX deployment. The supplied vector also indicates that user interaction is required.
How severe can exploitation be?
The out-of-bounds heap write is attacker-positioned and attacker-valued. On a common embedded memory layout, it can reach the FX_MEDIA driver callback and provide control of the instruction pointer.