CVE-2026-89088— Parted: parted: denial of service via heap buffer overflow during fat16 resize
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 parted 中发现了一个漏洞。当处理 FAT16 卷时，libparted 的文件系统调整大小逻辑中存在基于堆的缓冲区溢出。攻击者可通过诱使用户或管理员调整一个包含畸形目录元数据的特制 FAT16 文件系统镜像的大小，从而触发对固定大小内存缓冲区的超大读取操作。该问题会导致内存损坏，进而引发应用程序崩溃，造成拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89088
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Parted: parted: denial of service via heap buffer overflow during fat16 resize
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-89088
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89088
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89088 (2)
-
-
🔗 2462951 – (CVE-2026-89088) CVE-2026-89088 parted: parted: Denial of Service via heap buffer overflow during FAT16 resize issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total
| CVE-2026-104715 | 7.8 HIGH | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by |
| CVE-2026-105958 | 7.5 HIGH | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-105959 | 7.5 HIGH | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati |
| CVE-2026-62439 | 7.0 HIGH | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow |
| CVE-2026-89085 | 6.6 MEDIUM | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 MEDIUM | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-85231 | 6.5 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de |
| CVE-2026-62438 | 6.1 MEDIUM | Gimp: gimp: paa integer overflow out-of-bounds read |
| CVE-2026-111555 | 6.0 MEDIUM | Luksmeta: missing slot-range validation permits out-of-gap device i/o |
| CVE-2026-89096 | 5.9 MEDIUM | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-89098 | 5.5 MEDIUM | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-85977 | 5.3 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re |
| CVE-2026-17591 | 3.6 LOW | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-111581 | 3.3 LOW | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad -
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad -
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read
Same weakness: CWE-787
-
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nest -
CVE-2026-105958
Spice-server: spice: heap oob read/write via unchecked migra -
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV -
CVE-2026-89062
联想能源管理驱动越界写入致蓝屏
V. Comments for CVE-2026-89088
No comments yet