The vulnerability contains a divide‑by‑zero error in the exFAT sync routine that occurs when the calculation n_fatent minus two evaluates to zero during a write or sync operation. Defined as CWE‑369, the flaw causes the library to perform an illegal division, resulting in a crash or hang. This denial of service impacts any application linking the library when it accesses an exFAT volume with crafted metadata

The vulnerability affects any firmware or embedded application that incorporates ChaN FatFs version R0.16 or earlier while operating on exFAT file systems. Common devices include consumer electronics, automotive control units, industrial controllers, and other embedded systems that compile the library into their stack. The description does not explicitly state whether the flaw is independent of the underlying operating system or hardware; however, the available information indicates it is specifically related to FatFs’s handling of exFAT sync logic

The CVSS v3.1 score of 4.6 classifies the impact. The EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver exFAT metadata that forces n_fatent minus two to equal zero during a write or sync operation. Based on the description, the likely attack vector is network‑delivered firmware or update media, an inference drawn from the mention that network‑delivered update media can make this remote in some pipelines. Successful exploitation would cause a crash or hang.