CVE-2026-89088 Parted: parted: denial of service via heap buffer overflow during fat16 resize
An attacker can cause a denial of service by tricking a user into resizing a malicious FAT16 image, triggering a heap buffer overflow in parted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-89088?
CVE-2026-89088 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 16 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
Weakness: CWE-787
Which versions are affected by CVE-2026-89088?
How do I fix CVE-2026-89088?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89088 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-89088 exists.
Sources
Also known as DEBIAN-CVE-2026-89088, ECHO-f23f-a455-73fe, GHSA-phmc-786q-m6fp, OESA-2026-4171, OESA-2026-4172, OESA-2026-4173 and 2 more.