OESA-2026-4677: mtools security update
Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win'95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), "bad block" map maintenance, access to remote floppy drives, Iomega ZIP disk protection, "secure" erase, display of file's on-disk layout, etc Security Fix(es):
GNU mtools before 4.0.50 has an out-of-bounds write in parsevses in vfat.c.(CVE-2026-118384)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/mtoolsto a version that resolves this vulnerability.Fixed in 4.0.43-3.oe2403sp1 - Upgrade
Upgrade
GNU mtoolsto a version that resolves this vulnerability.Fixed in 4.0.50
Event History
Frequently Asked Questions
Which systems are affected?
Systems using GNU mtools versions earlier than 4.0.50 are affected. The listed software is openEuler mtools.
What does exploitation require?
The CVSS vector indicates local access and user interaction are required, while no privileges are required. Successful exploitation can affect integrity and availability.
What is the underlying flaw?
The issue is an out-of-bounds write in the parse_vses function in vfat.c.