There is a small piece of software called FatFs that almost nobody has heard of and almost everybody uses. It is the code that lets a device read and write the FAT and exFAT formats on USB sticks and SD cards, and it ships quietly inside the firmware of cameras, drones, industrial controllers, and even security appliances. Last week the security firm runZero disclosed seven vulnerabilities in it, as reported by The Hacker News.

The flaws matter less for their individual severity than for where they live. Several remain unpatched, and the reason is structural: this is code buried deep inside devices that shipped years ago and are almost never updated. You cannot patch firmware you did not know contained a vulnerable library, and most organizations have no inventory of which of their embedded devices run FatFs at all.

That makes this the hardest kind of exposure to manage, because it defeats the usual playbook from both ends. There is often no fix to apply, and no clear list of what is affected. When patching is off the table, the only real defense is knowing precisely which devices in your environment run the affected code and what an attacker could reach from them, which is an attack-surface problem, not a patch problem.

Start by inventorying embedded and IoT devices that handle removable media or run FatFs-based firmware, segment them away from anything sensitive on the assumption a fix may never come, and press the vendors that are staying silent to say something.

Sources: The Hacker News, with the research by runZero.