OESA-2026-4678: mtools security update
Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win'95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), "bad block" map maintenance, access to remote floppy drives, Iomega ZIP disk protection, "secure" erase, display of file's on-disk layout, etc Security Fix(es):
GNU mtools before 4.0.50 has an out-of-bounds write in parsevses in vfat.c.(CVE-2026-118384)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/mtoolsto a version that resolves this vulnerability.Fixed in 4.0.43-3.oe2403sp3
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects GNU mtools versions earlier than 4.0.50. The provided advisory identifies the affected software as openEuler mtools.
What does exploitation require?
The supplied vector indicates local attack access, no privileges required, and user interaction required. The vulnerability is an out-of-bounds write in the parse_vses function in vfat.c.
What is the likely impact?
The provided severity vector indicates no confidentiality impact, low integrity impact, and high availability impact. The advisory rates the issue as medium severity with a score of 6.1.