{"schema":"threatline.record/2","record":{"id":"CVE-2026-118384","aliases":[],"summary":"GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.","details":"GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.","categories":["Unclassified"],"product":"mtools","vendor":"GNU","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118384","source_modified_at":"2026-10-28T03:01:38.786Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"mtools","vendor":"GNU","versions":[{"lessThanOrEqual":"4.0.49","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":6.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T02:53:38.786Z","modified_at":"2026-10-28T03:01:38.786Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118384","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T03:01:38.786Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz","tags":["product"]},{"source":"CVE List","url":"https://lists.gnu.org/archive/html/info-gnu/2025-06/msg00004.html","tags":["product"]},{"source":"CVE List","url":"https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L444-L445","tags":["product"]},{"source":"CVE List","url":"https://github.com/deepin-community/mtools/blob/16d295331a1cfbcf02ad0b2f03c9b906197cf3ee/vfat.c#L399","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T03:01:38.786Z","content_hash":"85bad8f77614f22e25ac43f657df26f99281cc15dbcf3e5d7ff4744404ebe4a4"}}