{"id":"MGASA-2026-0512","summary":"Updated parted package fixes security vulnerabilities","details":"A heap-based buffer overflow can occur when processing a specially\ncrafted FAT32 filesystem due to an integer calculation error during\nbuffer allocation. A local attacker could exploit this by enticing a\nuser or automated service to open a malicious filesystem image,\nresulting in an application crash leading to a Denial of Service (DoS)\nor potential memory corruption.\nA heap-based buffer overflow exists in libparted's file system resizing\nlogic when handling FAT16 volumes. By convincing a user or administrator\nto resize a specially crafted FAT16 file system image with malformed\ndirectory metadata, an attacker can trigger an oversized read into a\nfixed-size memory buffer. This issue causes memory corruption, resulting\nin an application crash and a denial of service (DoS).\n","modified":"2026-10-17T03:30:03.782633533Z","published":"2026-10-17T03:21:49Z","upstream":["CVE-2026-89085","CVE-2026-89088"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0512.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36423"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2K3TJ47ZMRSILG3IESTHGOOFEBBL5HS4/"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6UHEOPPKU525Y6OAUPMV2W65RVVSAQ4V/"}],"affected":[{"package":{"name":"parted","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/parted?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-2.1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0512.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}