GNU mtools up to version 4.0.49 contains an out-of-bounds write in the parse_vses function of vfat.c. This defect can corrupt memory, potentially causing crashes or enabling an attacker to overwrite adjacent memory locations. If the overwritten data controls execution flow, the flaw could lead to arbitrary code execution on the host system. The weakness is classified as an out-of-bounds write (CWE-839).

The vulnerability affects the GNU mtools utility, specifically all releases up to and including 4.0.49. Users who have installed or rely on mtools 4.0.49 or earlier are exposed. The affected component is the vfat.c module that parses FAT filesystem images.

The CVSS score is 6.1, indicating a medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The likely attack vector is local: an adversary who can write or manipulate a FAT filesystem image processed by mtools can trigger the out-of-bounds write. Successful exploitation would require sufficient privileges to run mtools and write to memory, but the vulnerability could also be leveraged for privilege escalation from a lower-privileged user to a higher-privileged context if the application runs with elevated rights.