CVE-2026-118384
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- Record
CVE-2026-118384- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-839
- Updated
- 2026-11-02
EUVDEUVD-2026-111572
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- Record
EUVD-2026-111572- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9h57-5h59-g528
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
- Record
GHSA-9h57-5h59-g528- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-839
- Updated
- 2026-11-02
NVD
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- Record
CVE-2026-118384- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-839
- Updated
- 2026-11-02
OSVBELL-CVE-2026-118384
- Record
BELL-CVE-2026-118384- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-118384
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- Record
DEBIAN-CVE-2026-118384- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVOESA-2026-4676
mtools security update
Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win'95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), "bad block" map maintenance, access to remote floppy drives, Iomega ZIP disk protection, "secure" erase, display of file's on-disk layout, etc
Security Fix(es):
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.(CVE-2026-118384)
- Record
OESA-2026-4676- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-04
OSVOESA-2026-4677
mtools security update
Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win'95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), "bad block" map maintenance, access to remote floppy drives, Iomega ZIP disk protection, "secure" erase, display of file's on-disk layout, etc
Security Fix(es):
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.(CVE-2026-118384)
- Record
OESA-2026-4677- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-04
OSVOESA-2026-4678
mtools security update
Mtools is a collection of utilities to access MS-DOS disks from GNU and Unix without mounting them. It supports Win'95 style long file names, OS/2 Xdf disks and 2m disks (store up to 1992k on a high density 3 1/2 disk) In addition to file access, it supports many FAT-specific features: volume labels, FAT-specific file attributes (hidden, system, ...), "bad block" map maintenance, access to remote floppy drives, Iomega ZIP disk protection, "secure" erase, display of file's on-disk layout, etc
Security Fix(es):
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.(CVE-2026-118384)
- Record
OESA-2026-4678- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-118384
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- Record
UBUNTU-CVE-2026-118384- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
OSVAZL-111176 No score
CVE-2026-118384 affecting package mtools 4.0.43-2
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- Record
AZL-111176- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mtoolsAzure Linux:3 |
through 4.0.43-2 | None known |
mtoolsAlpaquita:stream |
4.0.39-r0 up to 4.0.50-r0 | 4.0.50-r0 |
mtoolsDebian:12 |
All versions, plus listed versions 4.0.33-1+really4.0.32-14.0.33-1+really4.0.32-1+hurd.14.0.43-14.0.47-14.0.48-14.0.48-24.0.49-1 |
None known |
mtoolsDebian:13 |
All versions, plus listed versions 4.0.48-14.0.48-24.0.49-1 |
None known |
mtoolsDebian:14 |
All versions, plus listed versions 4.0.48-14.0.48-24.0.49-1 |
None known |
mtoolsopenEuler:22.03-LTS-SP4 |
before 4.0.35-3.oe2203sp4 | 4.0.35-3.oe2203sp4 |
mtoolsopenEuler:24.03-LTS-SP1 |
before 4.0.43-3.oe2403sp1 | 4.0.43-3.oe2403sp1 |
mtoolsopenEuler:24.03-LTS-SP3 |
before 4.0.43-3.oe2403sp3 | 4.0.43-3.oe2403sp3 |
mtoolsUbuntu:16.04:LTS |
All versions, plus listed versions 4.0.18-24.0.18-2ubuntu0.16.04 |
None known |
mtoolsUbuntu:18.04:LTS |
All versions, plus listed versions 4.0.18-2ubuntu1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mtoolsUbuntu:20.04:LTS |
All versions, plus listed versions 4.0.23-14.0.23-24.0.23-34.0.24-1 |
None known |
mtoolsUbuntu:22.04:LTS |
All versions, plus listed versions 4.0.33-1+really4.0.32-14.0.33-1+really4.0.32-1build1 |
None known |
mtoolsUbuntu:24.04:LTS |
All versions, plus listed versions 4.0.43-14.0.43-1build1 |
None known |
mtoolsUbuntu:26.10 |
All versions, plus listed versions 4.0.49-1 |
None known |
mtoolsUbuntu:26.04:LTS |
All versions, plus listed versions 4.0.48-14.0.49-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, facts, references | EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118384 is a medium vulnerability (CVSS 6.1) in Gnu Mtools, published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in mtools 4.0.50-r0.
References
github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c
lists.gnu.org/archive/html/info-mtools/2026-10/msg00002.html
openwall.com/lists/oss-security/2026/10/31/1
nvd.nist.gov/vuln/detail/CVE-2026-118384
Show 10 moreShow less
ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz
docs.bell-sw.com/security/cves/CVE-2026-118384
security-tracker.debian.org/tracker/CVE-2026-118384
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4676
ubuntu.com/security/CVE-2026-118384
cve.org/CVERecord?id=CVE-2026-118384