CVE-2026-118384

A flaw was found in mtools. This out-of-bounds write vulnerability allows an attacker to cause a Denial of Service (DoS) or corrupt memory. By tricking a user into processing a specially crafted disk image containing malformed VFAT directory entries, the application writes beyond allocated buffer boundaries, resulting in an application crash.

This vulnerability is rated as Moderate for Red Hat Enterprise Linux because exploitation requires a user to explicitly inspect or manipulate an untrusted filesystem image using command-line utilities. In typical enterprise environments, mtools is not exposed as a continuously running network service or automated processing daemon, which confines any potential disruption strictly to the local context and execution lifecycle of the tool. Consequently, memory corruption leading to an unexpected process termination poses limited operational risk to the broader host system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.