What is the CVSS score of CVE-2026-6683?

CVE-2026-6683 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

FatFs CVE-2026-6683

EUVD-2026-40993 MEDIUM

Divide By Zero (CWE-369)

2026-07-01 runZero

GHSA-74cg-p8q3-4c3q

Information Disclosure Fatfs Chan

4.6

CVSS 3.1 · Vendor: runZero

Severity by source

Vendor (runZero) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.6 MEDIUM

Physical media insertion required (AV:P); no credentials needed; crash-only impact yields A:H with C:N and I:N.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (runZero).

CVSS VectorVendor: runZero

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:55 vuln.today

DescriptionCVE.org

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

AnalysisAI

Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes the expression n_fatent - 2 to evaluate to zero during write/sync operations, resulting in a hard fault or denial of service on the affected embedded device. The elm-chan FatFs library is widely bundled into microcontroller SDKs and IoT firmware, meaning the vulnerable code exists across a broad range of downstream products compiled with exFAT support. A proof-of-concept exists per SSVC assessment; no confirmed active exploitation (CISA KEV) has been recorded, and the physical attack vector limits mass exploitation, though network-accessible firmware update pipelines can extend effective reach.

Technical ContextAI

FatFs (CPE: cpe:2.3:a:chan:fatfs:*:*:*:*:*:*:*:*) is a generic FAT/exFAT filesystem module authored by ChaN and published at elm-chan.org, designed for resource-constrained microcontrollers and embedded RTOS environments. The root cause is CWE-369 (Divide By Zero): the exFAT sync logic uses n_fatent - 2 as a divisor to iterate FAT entries during write/sync operations but performs no guard check to ensure the result is non-zero. An exFAT volume with metadata engineered so that n_fatent equals exactly 2 collapses this expression to zero, triggering a divide-by-zero fault. Because FatFs is a library embedded at compile time - not a standalone service - the vulnerable code surface is determined by whether the integrating firmware enabled exFAT support; FAT12/FAT16/FAT32-only builds do not include the affected code path.

RemediationAI

The primary fix is to upgrade to a patched FatFs release once published by ChaN; as of this analysis, no confirmed fixed release version is available from the referenced data - the upstream project page at https://elm-chan.org/fsw/ff/ must be monitored for a new release. For deployments that cannot immediately update, the most effective compensating control is to disable exFAT support at compile time (removing the vulnerable code path entirely), which trades exFAT compatibility for eliminating the flaw with no runtime overhead. Alternatively, a targeted local patch can add a guard check ensuring n_fatent > 2 before executing the sync division - this preserves exFAT support but requires maintaining an out-of-tree patch across future FatFs updates. For devices with physical media ingestion, restricting media acceptance to cryptographically verified, trusted sources (signed volume images) reduces the likelihood of a crafted volume reaching the device, though this is a defense-in-depth measure rather than a fix. In OTA or network-accessible update pipelines, input validation of volume metadata prior to mount should be enforced as an immediate compensating control. Consult the runZero advisory at https://www.runzero.com/advisories/fatfs-exfat-divide-by-zero-cve-2026-6683 for updated patch guidance.