OESA-2026-4751: mtools security update

Q: What versions are affected?

GNU mtools versions before 4.0.50 are affected by the out-of-bounds write in parse_vses in vfat.c. The provided advisory identifies the affected software as openEuler mtools.

Q: What level of access does an attacker need?

The supplied CVSS vector indicates local attack access, no privileges required, and user interaction required. It also indicates high availability impact and low integrity impact, with no confidentiality impact.

Published Nov 11, 2026

Updated

Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win&apos;95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), &quot;bad block&quot; map maintenance, access to remote floppy drives, Iomega ZIP disk protection, &quot;secure&quot; erase, display of file&apos;s on-disk layout, etc Security Fix(es):

GNU mtools before 4.0.50 has an out-of-bounds write in parsevses in vfat.c.(CVE-2026-118384)

Affected Software

1 affected componentFixes available

openeuler/mtools<4.0.43-3.oe2403sp4

4.0.43-3.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/mtools to a version that resolves this vulnerability.
Fixed in 4.0.43-3.oe2403sp4
Upgrade
Upgrade GNU mtools to a version that resolves this vulnerability.
Fixed in 4.0.50

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118384

Frequently Asked Questions

What versions are affected?

GNU mtools versions before 4.0.50 are affected by the out-of-bounds write in parse_vses in vfat.c. The provided advisory identifies the affected software as openEuler mtools.

What level of access does an attacker need?

The supplied CVSS vector indicates local attack access, no privileges required, and user interaction required. It also indicates high availability impact and low integrity impact, with no confidentiality impact.

OESA-2026-4751: mtools security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What versions are affected?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

What versions are affected?

What level of access does an attacker need?