Cyber ·
GNU mtools 4.0.50 fixes CVE-2026-118384, an out-of-bounds write
GNU mtools version 4.0.50 has been released and is linked to CVE-2026-118384: an out-of-bounds write in parse_vses, in vfat.c, present up to version 4.0.49. The advisory circulated on the oss-sec list on 30 October 2026.
According to the CVE record cited in the source, GNU mtools up to version 4.0.49 contains an out-of-bounds write in the parse_vses function, in the vfat.c file. Version 4.0.50 is presented as the update that addresses this problem. The source is an automatic translation of a notice published on the oss-sec list on 30 October 2026, which relays the release announcement sent to the GNU information list. The text also indicates that a bug report on the mtools discussion list appears to describe the issue. The source does not detail impact, exploitation conditions or mitigations beyond the update. To verify, consult the official CVE record, the GNU mtools release notes and the bug report in the project's public list archive. Relevance to Rota Nacional: the platform does not patch or protect third-party libraries, and this item does not describe any Rota feature. Anyone using mtools in routines with disk images or sensitive documents should update the package to the fixed version once it is available in their distribution.
Original source: GNU mtools 4.0.50 lançado com correção para CVE-2026-118384