---
id: "CVE-2026-89085"
kind: "vulnerability"
aliases: ["CVE-2026-89085"]
title: "parted: heap overflow on crafted FAT32 image crashes or corrupts memory"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["disk-tooling", "fat32", "linux", "package", "parted"]
not_affected_if: ["fat32-not-used", "no-untrusted-images"]
published_at: "2026-10-16T23:17:02+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:47:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89085", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# parted: heap overflow on crafted FAT32 image crashes or corrupts memory

parted, the GNU disk partitioning tool, has a heap buffer overflow when it parses a specially crafted FAT32 filesystem because of an integer error during buffer allocation. An attacker who gets a user or automated job to open a malicious filesystem image can crash the program or possibly corrupt memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `parted --version` and compare it with the fixed version in the sources, which is unknown.
- Check whether automated jobs run `parted` against disk or image files from untrusted sources.

## Fix

- Update the `parted` package from your distribution once a fixed build is published; the fixed version is unknown from these sources.
- Do not run `parted` on untrusted filesystem images until updated.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89085

## From the sources

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_