CVE-2026-6683

CVSS 3.1: 4.6 medium
EPSS: <1%p23
Published: Jul 1, 2026 · Jul 1, 2026
Modified: Oct 25, 2026

Analyze CVE-2026-6683 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-delivered update media can make this remote in some pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.

Vendors: elm-chan

Products: fatfs

Weakness: CWE-369

Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

2 stories

Seven Bugs in FatFs Put IoT and Embedded Devices at Risk

Security AffairsJul 6, 10:20 UTC · Jul 6, 2026Exploit / PoCCVE-2026-6682 CVE-2026-6683 CVE-2026-6687+43

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

The Hacker NewsJul 3, 20:19 UTC · Jul 3, 2026VulnerabilityCVE-2026-6682 CVE-2026-6687 CVE-2026-6688+45 · 2 reads