Zero Radar
← feed
HighVulnerabilityCVE-2026-118384updated 31 Oct 2026, 04:25 UTC

GNU mtools: memory write error when parsing FAT disk entries

The mtools tool, which reads and writes files on DOS-style (FAT) disks, can write data past the end of a memory area. This memory error can make the program misbehave.

Fixed in GNU mtools 4.0.50 · out Official, 2 sources
SeverityHighCVSS 6.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGNU mtools 4.0.50 · since 31 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c, a function that parses FAT directory entries.

Why it is dangerous: Users who run mtools on disk images or devices they do not fully trust may have the program crash or corrupt memory. The material does not describe other impacts.

Are you affected?

You are affected if you run GNU mtools version 4.0.49 or earlier.

GNU mtools through 4.0.49

What to do

  1. Update GNU mtools to 4.0.50 or later.
  2. Run mtools --version to confirm which version you have.
  3. Until you update, avoid opening FAT images or disks from untrusted sources with mtools.

Timeline

  1. 28 Oct 2026, 03:17 UTC
    Publicly disclosed
  2. 31 Oct 2026, 00:25 UTC
    Reported by oss-security · oss-security
  3. 31 Oct 2026, 00:30 UTC
    Picked up by Zero Radar
  4. 31 Oct 2026, 04:25 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-118384
CVSS
6.1 / 10
Disclosed
28 Oct 2026, 03:17 UTC
On Zero Radar
31 Oct 2026, 00:30 UTC (3 days after disclosure)
Last change
31 Oct 2026, 04:25 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GNU mtools: memory write error when parsing FAT disk entries · Zero Radar