CVE-2026-89085

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

This vulnerability is rated as Moderate impact because exploitation requires a local user or automated process to inspect or resize an untrusted, specially crafted FAT32 filesystem using parted. In typical Red Hat Enterprise Linux deployments, parted is executed manually by administrative users rather than operating as an unprivileged or network-exposed daemon. Consequently, the flaw cannot be triggered without direct user interaction or file processing, and any resulting heap corruption remains confined to the executing process, primarily causing a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.