CVE-2026-89088CWE-787

CVE-2026-89088

Medium · published October 17, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00117 · 1.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-10-17T03:17Z
References (3)
EPSS history
Timeline
  • 20 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 16 OCT 23:06Z
    Parted: parted: denial of service via heap buffer overflow during fat16 resize
    cvelistv5
  • 16 OCT 23:06Z
    Parted: parted: denial of service via heap buffer overflow during fat16 resize
    cvelistv5