---
id: CVE-2026-118384
title: GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
summary: GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-839
vendor: GNU
product: mtools
affected:
  - mtools <= 4.0.49
published: '2026-10-28'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T03:06:13.418Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118384'
references:
  - url: 'https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz'
  - url: 'https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00004.html'
  - url: >-
      https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L444-L445
  - url: >-
      https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L399
tags:
  - cve.org
epss: 0.0032
epssPercentile: 0.25049
ingestedAt: '2026-10-28T03:02:57.607Z'
---

## Overview

GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.

## Affected

- `mtools <= 4.0.49`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.