Description
FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Published: 2026-07-01
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

earlier contain a divide‑by‑zero error in the exFAT sync routine that occurs when the calculation n_fatent minus two evaluates to zero during a write or sync operation. The flaw, defined as CWE‑369, causes the library to perform an illegal division, resulting in a crash or hang. This denial of service impacts any application linking the library when it accesses an exFAT volume with crafted metadata; no reported.

Affected Systems

The vulnerability affects any firmware or embedded application that incorporates ChaN FatFs version R0.16 or earlier while operating on exFAT file systems. Common devices include consumer electronics, automotive control units, industrial controllers, and other embedded systems that compile the library into their stack. The flaw is independent of the underlying operating system or hardware and relies solely on the library’s handling of exFAT sync logic.

Risk and Exploitability

The CVSS v3.1 score of 4.6 classifies the impact. The EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver exFAT metadata that forces n_fatent minus two to equal zero during a write or sync operation. This could be achieved through network‑delivered firmware or update media in some deployment pipelines. Successful exploitation would cause a crash or hang.

Generated by OpenCVE AI on July 21, 2026 at 14:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FatFs to a release newer than R0.16 that includes the divide‑by‑a runtime guard that checks whether n_fatent is greater than 2 before performing the division, or apply a custom patch that inserts this check.
  • Limit or suspend on exFAT volumes during critical periods, or migrate critical data to an unaffected file‑system format.
  • If a temporary mitigation is required, consider disabling exFAT support applied.

Generated by OpenCVE AI on July 21, 2026 at 14:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Chan
Chan fatfs
Vendors & Products Chan
Chan fatfs

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.
Title FatFs Divide-by-Zero in exFAT Sync
Weaknesses CWE-369
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Chan Fatfs
cve-icon MITRE

Status: PUBLISHED

Assigner: runZero

Published:

Updated: 2026-07-01T15:24:56.449Z

Reserved: 2026-04-20T15:06:19.048Z

Link: CVE-2026-6683

cve-icon Vulnrichment

Updated: 2026-07-01T15:24:51.337Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:45:02Z

Weaknesses