CVE-2026-91041 in ThreadX
Summary
by MITRE • 10/20/2026
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability described involves a critical security flaw within the FAT file system implementation, specifically when handling images with fault tolerance features enabled. This issue manifests as an out-of-bounds heap write during the log replay process, which is a mechanism used to ensure data integrity after unexpected shutdowns or crashes. When an attacker mounts a maliciously crafted FAT image that triggers this specific code path, they can exploit the improper bounds checking in the logging subsystem. The core technical flaw lies in the failure of the system to validate the size and position of log entries before writing them back to memory structures associated with the file system driver. This lack of validation allows an attacker-controlled payload to be written beyond the allocated boundaries of the intended buffer, leading to heap corruption.
The operational impact of this vulnerability is severe due to its potential for remote code execution or arbitrary control flow hijacking. The out-of-bounds write is not random; it is precisely positioned and valued by the attacker through careful construction of the malicious FAT image. On common embedded memory layouts, where data structures are often placed in close proximity within the heap, this overflow directly overwrites critical function pointers or callback addresses associated with the FX_MEDIA driver. By manipulating these overwritten values to point to shellcode or other executable payloads stored elsewhere in the controlled memory space, an attacker gains full control of the instruction pointer. This effectively allows for arbitrary code execution on the affected device, compromising confidentiality, integrity, and availability.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing data to a memory location outside the bounds of the allocated buffer. Furthermore, given that the attack vector relies on mounting a specific file system image to trigger code execution via heap corruption and instruction pointer manipulation, it maps closely to ATT&CK technique T1203: Exploitation for Client Execution or potentially T1496: Resource Hijacking if used for denial of service, though the primary capability is exploitation. The scenario highlights a common risk in embedded systems where file system drivers must handle untrusted input from removable media without sufficient sanitization or boundary checks.
Mitigation strategies should focus on implementing rigorous input validation and bounds checking within the FAT driver's log replay logic. Developers must ensure that all offsets, sizes, and pointers derived from the mounted image are validated against the actual allocated buffer limits before any write operations occur. Additionally, employing memory protection mechanisms such as Heap Protection or Address Space Layout Randomization can help mitigate the impact of heap corruption by making it more difficult for attackers to predict target addresses. Updating to patched versions of the operating system or file system library that address this specific flaw is essential for systems exposed to untrusted storage media. Regular security audits and static analysis tools configured to detect out-of-bounds writes in C/C++ codebases can also help identify similar vulnerabilities before deployment.