{"id":"CVE-2026-118384","kind":"vulnerability","aliases":["CVE-2026-118384"],"related":[],"title":"GNU mtools: out-of-bounds write in FAT parsing may corrupt memory","description":"GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.","summary":"GNU mtools through 4.0.49 has an out-of-bounds write in the parse_vses function in vfat.c, which handles VFAT long file names. A crafted FAT disk image processed by mtools can write memory outside its buffer, which can crash the tool or possibly run attacker-controlled code.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-images","embedded","linux","mtools","other"],"not_affected_if":["no-untrusted-fat-images"],"how_to_check":"- Run `mtools --version` (or `mtools -V`) to see whether the installed version is 4.0.49 or earlier.\n- Run `dpkg -l mtools` or `rpm -q mtools` to confirm the packaged version on Linux.","fix":"- Upgrade mtools to a release later than `4.0.49` once a fixed version is published by your distribution; the sources do not name a fixed version.\n- Until patched, avoid running mtools on untrusted disk images.","status":"open","published_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:45+00:00","updated_at":"2026-10-28T03:32:45+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T03:32:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade mtools to a release later than `4.0.49` once a fixed version is published by your distribution; the sources do not name a fixed version.\n- Until patched, avoid running mtools on untrusted disk images.","reach":"local","title":"GNU mtools: out-of-bounds write in FAT parsing may corrupt memory","impact":"medium","summary":"GNU mtools through 4.0.49 has an out-of-bounds write in the parse_vses function in vfat.c, which handles VFAT long file names. A crafted FAT disk image processed by mtools can write memory outside its buffer, which can crash the tool or possibly run attacker-controlled code.","category":"other","nicknames":[],"who_cares":["mtools","linux","embedded","disk-images"],"confidence":0.5,"needs_auth":"no","worst_case":"Memory corruption in mtools could crash it or run attacker code","analyst_note":"Check the NVD entry and the GNU mtools mailing list or upstream repository for the patched version and whether code execution is demonstrated.","how_to_check":"- Run `mtools --version` (or `mtools -V`) to see whether the installed version is 4.0.49 or earlier.\n- Run `dpkg -l mtools` or `rpm -q mtools` to confirm the packaged version on Linux.","needs_analyst":true,"not_affected_if":["no-untrusted-fat-images"],"who_is_affected":"Teams that run mtools (mcopy, mdir, mtype and similar) against disk images or floppy images from outside sources, such as file transfer, forensic, or embedded build pipelines. Systems that never open untrusted FAT images are unlikely to be exposed. The sources do not say whether network services use mtools to parse input.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3253,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118384':16A,19A '-2026':15A,18A '4.0.49':29B,79C 'attack':73B 'attacker-control':72B 'bound':6A,35B,85C 'buffer':63B 'code':75B 'control':74B 'corrupt':12A 'craft':51B 'crash':66B 'cve':14A,17A 'disk':21B,53B 'disk-imag':20B 'embed':23B 'fat':9A,52B 'file':48B 'function':41B 'gnu':1A,26B,76C 'handl':45B 'imag':22B,54B 'linux':24B 'long':47B 'may':11A 'memori':13A,60B 'mtool':2A,25B,27B,57B,77C 'name':49B 'out-of-bound':3A,32B,82C 'outsid':61B 'pars':10A,39B,88C 'possibl':70B 'process':55B 'run':71B 'tool':68B 'vfat':46B 'vfat.c':43B,91C 'vses':40B,89C 'write':7A,36B,59B,86C","nicknames":[],"mitigations":[],"who_affected":"Teams that run mtools (mcopy, mdir, mtype and similar) against disk images or floppy images from outside sources, such as file transfer, forensic, or embedded build pipelines. Systems that never open untrusted FAT images are unlikely to be exposed. The sources do not say whether network services use mtools to parse input.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118384","severity":null,"published_at":"2026-10-28T03:17:14+00:00","modified_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}