{"id":"CVE-2026-118384","title":"GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.","summary":"GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-839"],"vendor":"GNU","product":"mtools","affected":["mtools <= 4.0.49"],"published":"2026-10-28","updated":"2026-10-31","sourceUpdated":"2026-10-31T03:06:13.418Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118384","references":[{"url":"https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz"},{"url":"https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00004.html"},{"url":"https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L444-L445"},{"url":"https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L399"}],"tags":["cve.org"],"epss":0.0032,"epssPercentile":0.25049,"ingestedAt":"2026-10-28T03:02:57.607Z","slug":"CVE-2026-118384","body":"## Overview\n\nGNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.\n\n## Affected\n\n- `mtools <= 4.0.49`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}