Out-of-Bounds Write Vulnerability in GNU mtools by GNU
CVE-2026-118384

6.1MEDIUM

Key Information:

Vendor

Gnu
Status
Mtools
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118384?

GNU mtools version 4.0.49 is susceptible to an out-of-bounds write error in the parse_vses function found in vfat.c. This vulnerability arises when the software improperly handles certain input values, potentially leading to memory corruption or unexpected behavior. Users are encouraged to review their implementations and update to the latest version to mitigate any security risks. For further details, refer to the official release and community discussions.

Affected Version(s)

mtools 0 <= 4.0.49

References

https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz
product
https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00...
product
https://github.com/deepin-community/mtools/blob/16d295331...
product

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.