CVE-2026-91041CWE-1284CWE-787
CVE-2026-91041
High · published October 20, 2026
What it is
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.
The record
Technical detail
- CVSS v3.1
- 7.8 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00164 · 5.3th percentile
- Weaknesses
- CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-787 · Out-of-bounds Write
- Published
- 2026-10-20T18:17Z
References (1)
EPSS history
Timeline
22 OCT 03:36Z
EPSS moved — → 0%
epss
20 OCT 13:10Z
FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
cvelistv5
20 OCT 13:10Z
FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
cvelistv5