diff --git a/components/fatfs/sbom.yml b/components/fatfs/sbom.yml
index c82d5ba5d94..d69a672ce6c 100644
--- a/components/fatfs/sbom.yml
+++ b/components/fatfs/sbom.yml
@@ -6,3 +6,5 @@ description: 'Generic FAT Filesystem Module for embedded systems.'
 cve-exclude-list:
   - cve: CVE-2026-6682
     reason: Integer overflow in exFAT mount size validation. Patched by promoting the cluster-heap and bitmap-base multiplies to 64-bit in mount_volume().
+  - cve: CVE-2026-6683
+    reason: exFAT divide-by-zero when NumClusters == 0. The vulnerable exFAT PercInUse sync division was introduced in R0.16 and is not present in this R0.15 release; an empty cluster heap is additionally rejected at mount as defense-in-depth.
diff --git a/components/fatfs/src/ff.c b/components/fatfs/src/ff.c
index d1c8903ee88..1286aa7776a 100644
--- a/components/fatfs/src/ff.c
+++ b/components/fatfs/src/ff.c
@@ -3481,6 +3481,7 @@ static FRESULT mount_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 
 		nclst = ld_dword(fs->win + BPB_NumClusEx);		/* Number of clusters */
 		if (nclst > MAX_EXFAT) return FR_NO_FILESYSTEM;	/* (Too many clusters) */
+		if (nclst == 0) return FR_NO_FILESYSTEM;		/* CVE-2026-6683: reject empty exFAT cluster heap (malformed zero-data-cluster volume; the divide-by-(n_fatent-2) sink itself was introduced in R0.16) */
 		fs->n_fatent = nclst + 2;
 
 		/* Boundaries and Limits */