CVE-2026-89088

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local user interaction with a specifically crafted FAT16 storage device or image, limiting the blast radius to a denial of service. Under default Red Hat Enterprise Linux configurations, partition resizing operations using parted or libparted are interactive administrative tasks that are not routinely invoked automatically on untrusted media. Consequently, an attacker cannot remotely compromise the system or escalate privileges, as the defect only triggers an immediate application termination during targeted filesystem adjustments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.