[ CVE-2026-118384 · Published 28 Oct 2026 ]
Vulnerability in GNU mtools
CVSS 6.1
EPSS <1%No fix listed yet
[ Description ]Official description
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c
- github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c
- lists.gnu.org/archive/html/info-mtools/2026-10/msg00001.html
- lists.gnu.org/archive/html/info-mtools/2026-10/msg00002.html
- lists.gnu.org/archive/html/info-mtools/2026-10/msg00004.html
- www.openwall.com/lists/oss-security/2026/10/31/1