CVE-2026-89085

Received Received - Intake

Heap-based Buffer Overflow in Parted

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-89085

EUVD

EUVD-2026-103202

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow vulnerability in the parted tool. It occurs when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. This can lead to an application crash or memory corruption if exploited by a local attacker.

Detection Guidance

This vulnerability is related to a flaw in the parted tool when handling FAT32 filesystems. Detection involves checking for the parted version and scanning for malicious FAT32 filesystem images. Use parted --version to check the installed version. Monitor system logs for crashes or memory corruption errors during filesystem operations.

Impact Analysis

A local attacker could exploit this by tricking you or an automated service into opening a malicious filesystem image. This may cause the affected application to crash, resulting in a Denial of Service (DoS) or potential memory corruption on your system.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) or memory corruption via a heap-based buffer overflow in parted when processing malicious FAT32 filesystems. It does not directly disclose or modify sensitive data, so its impact on GDPR or HIPAA compliance is likely minimal unless it leads to system unavailability affecting data access or processing.

Mitigation Strategies

Update the parted package to the latest version provided by your distribution vendor to patch the integer calculation error in FAT32 filesystem handling.

Hi! I’m here to help you understand CVE-2026-89085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70