CVE-2026-89088

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 19, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-890896.5A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A lo CVE-2026-89094.3The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to miss CVE-2026-890905.9An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated CVE-2026-890918.8A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates mem CVE-2026-890924.2The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a respo CVE-2026-890935.3The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by CVE-2026-890949.9Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templat CVE-2026-890965.9A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notificati CVE-2026-890974.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i CVE-2026-890985.5A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program asserti CVE-2026-890997.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory wi CVE-2026-89106.1The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is