Live › vulnerability › CVE-2026-89088
Go to dashboardA heap-based buffer overflow in libparted's file system resizing code, triggered by malformed directory metadata in a FAT16 volume, causes a read past a fixed-size buffer. An attacker who gets a user or administrator to resize a crafted FAT16 image can crash the application and cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run parted or libparted to resize file systems, especially on disk images or volumes from untrusted sources. The sources describe a user or administrator being convinced to resize a specially crafted FAT16 image, so routine resizing of trusted local disks carries little exposure. Systems that never run parted's resize on FAT16 can skip it.
No product ranges from the sources yet.
parted --version to see the installed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
This page as .md · .json · in your agent: get_signal("CVE-2026-89088")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.