CVE-2026-6683 Details
Description
FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
A divide-by-zero vulnerability has been identified in the exFAT synchronization logic of FatFs versions prior to R0.16. This vulnerability occurs when crafted metadata causes the calculation of 'n_fatent - 2' to equal zero during write or synchronization operations, leading to a system crash. This issue, which maps to CWE-369, can be exploited remotely in certain scenarios, particularly through network-delivered update media that is not properly validated before being mounted.
Users are advised to update to FatFs version R0.16 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | CISA-ADP | Third Party AdvisoryExploit |
| https://elm-chan.org/fsw/ff/ | runZero | Product |
| https://github.com/runZeroInc/vulns-2026-fatfs-chance | runZero | Third Party AdvisoryExploit |
| https://www.runzero.com/advisories/fatfs-exfat-divide-by-zero-cve-2026-6683 | runZero | Third Party Advisory |
| https://www.runzero.com/blog/fatfs-bugs/ | runZero | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-369 | Divide By Zero | runZero |
Affected Products
| Product | Versions |
|---|---|
| elm-chan fatfs | <= r0.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | runZero |