CVE-2026-118384
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
- Risk score
- 42/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
- https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz
- https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L399
- https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L444-L445
- https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00004.html
Original description
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
Last activity 28 Oct 2026. Patch Forecast updates every hour.