{"id":"CVE-2026-89085","kind":"vulnerability","aliases":["CVE-2026-89085"],"related":[],"title":"parted: heap overflow on crafted FAT32 image crashes or corrupts memory","description":"A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.","summary":"parted, the GNU disk partitioning tool, has a heap buffer overflow when it parses a specially crafted FAT32 filesystem because of an integer error during buffer allocation. An attacker who gets a user or automated job to open a malicious filesystem image can crash the program or possibly corrupt memory.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-tooling","fat32","linux","package","parted"],"not_affected_if":["fat32-not-used","no-untrusted-images"],"how_to_check":"- Run `parted --version` and compare it with the fixed version in the sources, which is unknown.\n- Check whether automated jobs run `parted` against disk or image files from untrusted sources.","fix":"- Update the `parted` package from your distribution once a fixed build is published; the fixed version is unknown from these sources.\n- Do not run `parted` on untrusted filesystem images until updated.","status":"open","published_at":"2026-10-16T23:17:02+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:47:01+00:00","updated_at":"2026-10-25T03:47:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the `parted` package from your distribution once a fixed build is published; the fixed version is unknown from these sources.\n- Do not run `parted` on untrusted filesystem images until updated.","reach":"local","title":"parted: heap overflow on crafted FAT32 image crashes or corrupts memory","impact":"medium","summary":"parted, the GNU disk partitioning tool, has a heap buffer overflow when it parses a specially crafted FAT32 filesystem because of an integer error during buffer allocation. An attacker who gets a user or automated job to open a malicious filesystem image can crash the program or possibly corrupt memory.","category":"package","nicknames":[],"who_cares":["parted","linux","fat32","disk-tooling"],"confidence":0.6,"needs_auth":"no","worst_case":"Program crashes, or memory is corrupted when a malicious image is opened.","analyst_note":"","how_to_check":"- Run `parted --version` and compare it with the fixed version in the sources, which is unknown.\n- Check whether automated jobs run `parted` against disk or image files from untrusted sources.","needs_analyst":false,"not_affected_if":["no-untrusted-images","fat32-not-used"],"who_is_affected":"Systems where parted is installed and used to inspect or process FAT32 images or disks from sources outside the team's control, such as user uploads, downloaded images or automated ingestion pipelines. Systems that only ever handle their own disks or never run parted on FAT32 data can skip it. The sources do not describe a remote trigger.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3312,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-89085':14A,17A 'alloc':51B,104C 'applic':127C 'attack':53B,107C 'autom':59B,116C 'base':84C 'buffer':34B,50B,85C,103C 'calcul':100C 'corrupt':10A,73B,139C 'could':108C 'craft':5A,41B,93C 'crash':8A,68B,128C 'cve':12A,15A 'denial':132C 'disk':19B,28B 'disk-tool':18B 'dos':135C 'due':96C 'entic':112C 'error':48B,101C 'exploit':109C 'fat32':6A,21B,42B,94C 'filesystem':43B,65B,95C,122C 'flaw':76C 'found':78C 'get':55B 'gnu':27B 'heap':2A,33B,83C 'heap-bas':82C 'imag':7A,66B,123C 'integ':47B,99C 'job':60B 'lead':129C 'linux':22B 'local':106C 'malici':64B,121C 'memori':11A,74B,138C 'occur':88C 'open':62B,119C 'overflow':3A,35B,86C 'packag':23B 'pars':38B 'part':1A,24B,25B,80C 'partit':29B 'possibl':72B 'potenti':137C 'process':90C 'program':70B 'result':124C 'servic':117C,134C 'special':40B,92C 'tool':20B,30B 'user':57B,114C","nicknames":[],"mitigations":[],"who_affected":"Systems where parted is installed and used to inspect or process FAT32 images or disks from sources outside the team's control, such as user uploads, downloaded images or automated ingestion pipelines. Systems that only ever handle their own disks or never run parted on FAT32 data can skip it. The sources do not describe a remote trigger.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89085","severity":null,"published_at":"2026-10-16T23:17:02+00:00","modified_at":"2026-10-19T21:03:27+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}