Medium severity · published Oct 28, 2026
CVE-2026-118384
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c
New
6.1
CVSS
–
EPSS
No
On KEV
Description
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
mtools · GNU
through 4.0.49 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118384
product
https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz
product
https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00004.html
product
https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L444-L445
product
https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L399