OESA-2026-4676: mtools security update
Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win'95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), "bad block" map maintenance, access to remote floppy drives, Iomega ZIP disk protection, "secure" erase, display of file's on-disk layout, etc Security Fix(es):
GNU mtools before 4.0.50 has an out-of-bounds write in parsevses in vfat.c.(CVE-2026-118384)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/mtoolsto a version that resolves this vulnerability.Fixed in 4.0.35-3.oe2203sp4 - Upgrade
Upgrade
GNU mtoolsto a version that resolves this vulnerability.Fixed in 4.0.50
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker needs local access and must persuade a user to interact with crafted input. No privileges are required according to the provided CVSS vector.
Which installations are affected?
GNU mtools versions before 4.0.50 are affected. The advisory identifies the openEuler mtools package, but does not provide specific fixed package builds or releases.
What is the potential impact?
The flaw is an out-of-bounds write in parse_vses in vfat.c. The provided severity data indicates it can cause high availability impact and low integrity impact, with no confidentiality impact.