{"id":"AZL-109733","summary":"CVE-2026-111581 affecting package libblockdev 3.2.0-1","details":"A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.","modified":"2026-10-21T14:17:40.802803956Z","published":"2026-10-16T16:17:04Z","upstream":["CVE-2026-111581"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111581"}],"affected":[{"package":{"name":"libblockdev","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/libblockdev"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.0-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109733.json"}}],"schema_version":"1.9.0"}