CVE-2026-6683: FatFs exFAT divide-by-zero DoS vulnerability analysis

Vulnerability Overview Vulnerability Name: FatFs exFAT divide-by-zero in sync/write paths CVE ID: CVE-2026-6683 CVSS Score: 3.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Technical Impact: Partial Affected Scope Affected Product: FatFs Affected Versions: ChaN's FatFs R0.16 and earlier Downstream Projects: STMicroelectronics Middleware FatFS MCU, Zephyr Project Zephyr RTOS, ArduPilot, RT-Thread, RIOT OS, Arm Limited Mbed, Samsung TizenRT, Damien P. George's MicroPython, Edy555's NanoVNA, and Stefano Babic's SWUpdate. Remediation Fix Status: No specific remediation is mentioned; however, it is recommended to update to the latest version or apply patches. Technical Details Vulnerability Description: The exFAT free-space accounting path performs arithmetic operations assuming a non-zero divisor. Trigger Conditions: When an exFAT volume is created with , the calculated cluster domain folds to , resulting in . Any write, sync, or close path reaching will cause a SIGFPE/hard fault, leading to an immediate crash. POC Code Attacker Value Attacker Capability: An attacker can reliably crash systems writing to created exFAT media. In embedded products, this can lead to persistent operational denial of service. In OTA/update workflows, it may cause mid-update failures or brick behavior. Timeline 2026-03-17: Initial discovery and documentation 2026-04-20: CVE ID reserved 2026-04-20: First contact with vendor, no response 2026-04-27: Contacted JPCERT/CC for coordination assistance 2026-04-28: JPCERT/CC contacted vendor, no response 2026-05-14: Contacted major downstream implementers, did not receive full details 2026-06-18: Updated JPCERT/CC and downstream vendors; disclosure date changed to July 1 2026-07-01: Public disclosure of CVE-2026-6683 Credits Discoverer: Tod Beardsley CVE Coordination: Tod Beardsley Subscription Subscription Link: Stay updated with the latest news and expert insights Footer Copyright: © Copyright 2026 runZero, Inc. All Rights Reserved Legal Policies: Privacy Policy, Do Not Sell or Share My Personal Information, Master Subscription Agreement, Manage Subscriptions

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-6683: FatFs exFAT divide-by-zero DoS vulnerability analysis