CVE-2026-6683

Analyzed Analyzed - Analysis Complete

Divide-by-Zero in FatFs exFAT Sync Logic

Publication date: 2026-07-01

Last updated on: 2026-07-02

Assigner: 44488dab-36db-4358-99f9-bc116477f914

Description

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-02

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-6683

EUVD

EUVD-2026-40993

Affected Vendors & Products

Vendor	Product	Version / Range
elm-chan	fatfs	to r0.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-369	The product divides a value by zero.

Attack-Flow Graph

Executive Summary

CVE-2026-6683 is a divide-by-zero vulnerability in ChaN's FatFs exFAT implementation, affecting versions R0.16 and earlier.

The flaw occurs in the exFAT sync and write paths when specially crafted metadata causes the divisor (n_fatent - 2) to become zero, leading to a crash during write, sync, or close operations.

This vulnerability maps to CWE-369 (Divide By Zero) and can cause denial of service by crashing the system handling the exFAT media.

Detection Guidance

This vulnerability manifests as a divide-by-zero error during exFAT write, sync, or close operations when handling crafted metadata. Detection involves monitoring for crashes or denial of service events related to FatFs exFAT operations, especially during media write or sync processes.

Since the vulnerability triggers a crash when n_fatent - 2 equals zero, you can detect it by observing system logs or error messages indicating divide-by-zero faults or abnormal termination of processes handling exFAT media.

No specific detection commands are provided in the available resources.

Impact Analysis

This vulnerability can cause denial of service by crashing embedded systems or devices that use the vulnerable FatFs exFAT implementation.

It can potentially brick embedded systems or cause persistent operational failures, especially in over-the-air (OTA) update workflows or any system processing untrusted exFAT media.

The vulnerability can be triggered remotely in some update pipelines, increasing the risk of exploitation.

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-6683 on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

Immediate mitigation steps include avoiding the use of untrusted or crafted exFAT media that could trigger the divide-by-zero condition during write or sync operations.

Since the vulnerability can be triggered remotely in some update pipelines, it is advisable to review and restrict update sources and media to trusted origins only.

Applying patches or updates from affected downstream projects or vendors once available is recommended to fully remediate the issue.

Hi! I’m here to help you understand CVE-2026-6683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70