A heap-based buffer overflow in the partitioning utility (CWE-787) can be triggered by a specially crafted FAT32 filesystem image. When an integer calculation error occurs during buffer allocation, the program can write beyond the bounds of the heap. A local attacker who can get the application to open a malicious image could cause a crash, leading to a denial of service or potentially corrupting memory for uncontrolled behavior.

The vulnerability affects Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10. All these systems run the bundled partitioning tool that is vulnerable to malformed FAT32 images.

The CVSS score is 6.6, indicating moderate severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. Because the flaw requires local execution on a target machine, exploitation would need a user or service on that system to open a malicious image; remote exploitation is not possible with the information provided. The risk to organizations is mainly an inadvertent denial of service that could impact user experience or service availability.