CVE-2026-118384

MediumCVSS 6.1/10Last modified Nov 9, 2026

Description

GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-839

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
GNUmtools< 4.0.50

References

Timeline

Published
Oct 28, 2026
Last modified
Nov 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1183866.5Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were dCVE-2026-118399.9Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell tCVE-2026-1183918.9Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust CVE-2026-1183944.3The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing theCVE-2026-1183957.5Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/CVE-2026-11847.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 tCVE-2026-118408.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticateCVE-2026-1184033.7The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, alloCVE-2026-1184045.3The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping caCVE-2026-1184054.3Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other usersCVE-2026-1184075.4The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any aCVE-2026-1184083.1Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role
CVE-2026-118384: Medium severity, CVSS 6.1 | Vulnix