Mtools
Monthly
Out-of-bounds write in GNU mtools through 4.0.49 occurs in parse_vses in vfat.c when a crafted FAT/VFAT disk image or device contains malformed VFAT long-filename sequence entries. Exploitation requires a local attacker to get the image onto the system and the victim to invoke an mtools utility such as mdir, mcopy, or minfo against it; no authentication is needed, but user interaction is required. CVSS 3.1 score is 6.1 (C:N/I:L/A:H), no public exploit or CISA KEV entry is identified at time of analysis, and the priority is moderate (this_month), not urgent.
Out-of-bounds write in GNU mtools through 4.0.49 occurs in parse_vses in vfat.c when a crafted FAT/VFAT disk image or device contains malformed VFAT long-filename sequence entries. Exploitation requires a local attacker to get the image onto the system and the victim to invoke an mtools utility such as mdir, mcopy, or minfo against it; no authentication is needed, but user interaction is required. CVSS 3.1 score is 6.1 (C:N/I:L/A:H), no public exploit or CISA KEV entry is identified at time of analysis, and the priority is moderate (this_month), not urgent.