Live › vulnerability › CVE-2026-89085
Go to dashboardparted, the GNU disk partitioning tool, has a heap buffer overflow when it parses a specially crafted FAT32 filesystem because of an integer error during buffer allocation. An attacker who gets a user or automated job to open a malicious filesystem image can crash the program or possibly corrupt memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems where parted is installed and used to inspect or process FAT32 images or disks from sources outside the team's control, such as user uploads, downloaded images or automated ingestion pipelines. Systems that only ever handle their own disks or never run parted on FAT32 data can skip it. The sources do not describe a remote trigger.
No product ranges from the sources yet.
parted --version and compare it with the fixed version in the sources, which is unknown.parted against disk or image files from untrusted sources.parted package from your distribution once a fixed build is published; the fixed version is unknown from these sources.parted on untrusted filesystem images until updated.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.
This page as .md · .json · in your agent: get_signal("CVE-2026-89085")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.