GNU mtools CVE-2026-118384

Exploitation requires the victim to invoke an mtools utility (e.g. mdir, mcopy, minfo) against an attacker-supplied FAT/VFAT disk image or device whose VFAT long-filename sequence entries are malformed so that parse_vses in vfat.c performs the out-of-bounds write. The limiting factors are significant: the CVSS vector is local (AV:L), so the attacker must get the crafted image onto a system the victim will process, and user interaction is required (UI:R) - the flaw does not trigger without someone deliberately running mtools on the image. No authentication is needed (PR:N). Affected scope is GNU mtools versions through 4.0.49; no non-default configuration is called out in the available sources, and the precise structural trigger beyond 'malformed VSE parsing' is not described.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (6.1, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) describes a local-only issue: the attacker needs no privileges but DOES require user interaction (UI:R), and the primary impact is availability (A:H, i.e. a crash) with only low integrity impact and no confidentiality impact. The vuln.today decision label is 'this_month' rather than act_now or emergency, which is consistent with a local-vector, interaction-dependent memory-safety bug. Key decision signals are MISSING from the input: no EPSS exploitation-probability score is provided, and there is no CISA KEV listing - so there is no evidence of active exploitation, and 'this_month' should be read as the ceiling of urgency here, not a floor. The references include source-code line pointers (deepin-community mirror of vfat.c around parse_vses) but these are code locations, not a working exploit, so there is no public exploit identified at time of analysis. CWE-839 (numeric range comparison without a minimum check) plus an out-of-bounds write is a classic memory-safety defect whose realistic ceiling is denial of service, with code execution unproven because the trigger's controllability is not described in the available sources. Net: a legitimate bug to patch on a normal cadence, not a high-CVSS-but-hollow issue and not a drop-everything emergency.

An attacker crafts a malformed FAT/VFAT disk image or device whose VFAT long-filename (VSE) sequence entries violate the expected numeric range, then induces a victim to process it with an mtools command (for example mdir, mcopy, or minfo). When parse_vses in vfat.c parses the crafted entries it performs an out-of-bounds write, corrupting memory and typically crashing the tool. No public exploit has been identified; exploitation requires local delivery of the image and the victim actively running mtools against it.