Live › vulnerability › CVE-2026-91041
Go to dashboardFileX fault-tolerant log replay (_fx_fault_tolerant_apply_logs) bounds the on-disk offset and size against the whole sector cache instead of one sector. A crafted FAT image therefore gets an out-of-bounds write that can overwrite the fx_media_driver_entry callback, which is called on the next line. On targets without an MMU, ASLR or W^X this gives code execution. A second, lesser bug is an out-of-bounds read of total_size when the log loads. Fixed in 6.5.2.202603.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| filex | vendor | <= 6.5.1.202602 | 6.5.2.202603 |
6.5.1.202602 (check the FileX version string or your vendored source), is built with FX_ENABLE_FAULT_TOLERANT, and calls fx_fault_tolerant_enable() at runtime6.5.2.202603 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.
This page as .md · .json · in your agent: get_signal("CVE-2026-91041")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.