CVE-2026-89085

MediumCVSS 6.6

Published: 16/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

A flaw was found in parted where a heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image.

Risk Assessment

This results in an application crash leading to a Denial of Service (DoS) or potential memory corruption. It may disrupt disk and partition management operations.

Recommendation

Update parted to a version containing the fix. Avoid opening untrusted FAT32 filesystem images.

Other vulnerabilities in parted

CVE-2026-89088Medium
A flaw was found in parted where a heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer.

Original NVD description (English source)

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS