Severity by source
Triggered by a crafted FAT image the victim must process (AV:L, UI:R, PR:N); heap overflow assessed as full memory-corruption impact, though it may be DoS-only (A:H) if it is an over-read.
Lifecycle Timeline
1DescriptionCVE.org
[heap buffer overflow in _init_fats / fat_table_read]
AnalysisAI
Heap buffer overflow in the FAT-filesystem parsing code paths identified as _init_fats and fat_table_read - most likely the libparted FAT module used by GNU Parted and its fatresize component - allows memory corruption when a malformed FAT volume is parsed. The issue is local in scope (AV:L) and requires user interaction (UI:R): a victim must open a crafted disk/partition image or insert a removable device whose FAT table has been manipulated, and a parsing path (resize, inspection, or a mount helper such as udisks auto-mount handling) must actually read that volume. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the affected FAT parser to process an attacker-supplied FAT filesystem - a crafted disk/partition image or a removable device with a manipulated FAT table - so the attacker must be able to deliver such media and the victim (or an auto-mount/parsing service such as udisks) must act on it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a heap buffer overflow in FAT-filesystem parsing routines (_init_fats / fat_table_read), reported by the Ubuntu security team - consistent with a fuzzing-discovered memory-safety bug in a C-based FAT reader (most likely the libparted FAT module used by GNU Parted/fatresize, though the exact package is NOT confirmed in the input). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not confirmed in the available data: no vendor-released fix version, commit, or PR is supplied, so no specific upgrade target can be recommended from this record - do not assume a fixed release exists until the Ubuntu security notice for this CVE names the source package and version, and apply that update as soon as it is published (subscribe to Ubuntu security notices for the package identified). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today