CVE-2026-118384 in mtools
Summary
by MITRE • 10/28/2026
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in GNU mtools versions up to and including 4.0.49 represents a critical memory safety issue located within the file system parsing logic for Virtual File System (VFS) FAT formats, specifically affecting the VFAT extension handling. The root cause of this flaw resides in the parse_vses function found within the vfat.c source module. This component is responsible for interpreting and processing Volume Set Extension descriptors during the enumeration or mounting of disk images formatted with FAT file systems that utilize these extensions. When mtools processes a crafted input, such as a maliciously constructed floppy image or hard drive sector dump containing malformed VFAT volume set extension data, it fails to adequately validate the length fields associated with these structures before attempting to copy them into fixed-size buffers in memory.
This lack of rigorous bounds checking leads directly to an out-of-bounds write condition. As the parser reads the potentially maliciously crafted descriptor headers, it calculates a destination address and size for copying data based on untrusted input values provided by the file system structure itself. If these values exceed the allocated buffer limits or the boundaries of the intended memory region, the write operation spills over into adjacent memory locations. This behavior is characteristic of CWE-787, which defines out-of-bounds writes as a class of vulnerabilities where data is written to a location outside the bounds of the intended buffer. Such errors are particularly dangerous because they can corrupt heap metadata, overwrite critical control flow pointers such as return addresses or function pointers, and alter adjacent variables that govern program logic.
The operational impact of this vulnerability extends beyond simple application crashes or denial-of-service scenarios involving segmentation faults. An attacker who can supply a malicious disk image to be processed by mtools could potentially achieve arbitrary code execution with the privileges of the user running the tool. Since mtools is often used for low-level disk manipulation and data transfer between different operating systems, it may run in contexts where users expect high levels of trust or automation. The ability to write beyond buffer boundaries allows an attacker to manipulate memory layout in ways that facilitate exploitation techniques detailed under MITRE ATT&CK technique T1203, which covers exploit public-facing applications for initial access or privilege escalation depending on the context. In automated environments such as CI/CD pipelines or backup systems where disk images are routinely processed without deep inspection, this vulnerability poses a significant risk of remote code execution if an attacker can inject malicious image files into the processing pipeline.
Mitigation strategies must focus primarily on updating to patched versions of GNU mtools that address these memory safety issues by implementing strict validation checks before performing any memory copy operations derived from file system structures. Developers and administrators should ensure that all instances of mtools are upgraded beyond version 4.0.49, where the fix for this specific out-of-bounds write in parse_vses has been applied. Additionally, organizations relying on automated disk image processing should implement input sanitization at higher layers or use sandboxed environments to limit the blast radius if a vulnerability is encountered. Regular auditing of file system parsing code against CWE-787 and related memory corruption patterns remains essential for maintaining robust security posture in tools that handle untrusted binary data formats.