mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
df3df94c58
CVE-2026-6683 is an exFAT divide-by-zero: with NumClusters == 0 the filesystem object has fs->n_fatent == 2, and the exFAT "percent in use" update in sync_fs() computes ... * 100 / (fs->n_fatent - 2) -> division by zero. That vulnerable exFAT PercInUse sync path was introduced in FatFs R0.16 and is NOT present in this R0.15 release, so the divide-by-zero itself is not reachable here. As defense-in-depth (and to keep parity with newer releases) reject an empty exFAT cluster heap at mount time, which is a malformed volume regardless. Record the CVE disposition in the component SBOM. Reference: https://www.runzero.com/blog/fatfs-bugs/