CVE-2026-118384: Medium severity GNU mtools vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must cause a user to process malicious input with GNU mtools. The CVSS vector indicates local attack access, no privileges required, and user interaction required.

Q: What is the potential impact?

Successful exploitation can cause an out-of-bounds write, with high availability impact and low integrity impact. No confidentiality impact is indicated by the provided CVSS vector.

Q: Which versions are affected?

GNU mtools through version 4.0.49 is affected according to the available data.

Published Oct 28, 2026

Updated

GNU mtools through 4.0.49 has an out-of-bounds write in parsevses in vfat.c.

Affected Software

1 affected component

GNU mtools<=4.0.49

Event History

Oct 28, 2026

CVE Published

via MITRE·02:53 AM

Data Sourced

via MITRE·02:53 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause a user to process malicious input with GNU mtools. The CVSS vector indicates local attack access, no privileges required, and user interaction required.

What is the potential impact?

Successful exploitation can cause an out-of-bounds write, with high availability impact and low integrity impact. No confidentiality impact is indicated by the provided CVSS vector.

Which versions are affected?