Live › vulnerability › CVE-2026-118384
Go to dashboardGNU mtools through 4.0.49 has an out-of-bounds write in the parse_vses function in vfat.c, which handles VFAT long file names. A crafted FAT disk image processed by mtools can write memory outside its buffer, which can crash the tool or possibly run attacker-controlled code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Teams that run mtools (mcopy, mdir, mtype and similar) against disk images or floppy images from outside sources, such as file transfer, forensic, or embedded build pipelines. Systems that never open untrusted FAT images are unlikely to be exposed. The sources do not say whether network services use mtools to parse input.
No product ranges from the sources yet.
mtools --version (or mtools -V) to see whether the installed version is 4.0.49 or earlier.dpkg -l mtools or rpm -q mtools to confirm the packaged version on Linux.4.0.49 once a fixed version is published by your distribution; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
This page as .md · .json · in your agent: get_signal("CVE-2026-118384")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.