CVE-2026-89088
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A flaw was found in parted where a heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer.
Risk Assessment
This issue causes memory corruption, resulting in an application crash and a denial of service (DoS). It may disrupt partitioning and disk management operations.
Recommendation
Update parted to a version containing the fix. Avoid resizing untrusted FAT16 file system images.
Other vulnerabilities in parted
Original NVD description (English source)
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS