CVE-2026-89085

Executive Summary

CVE-2026-89085 is a heap-based buffer overflow in GNU parted, an open-source disk partitioning utility used across Linux distributions and embedded storage workflows. The flaw is triggered when parted processes a specially crafted FAT32 filesystem image: an integer calculation error during buffer allocation leads to undersized memory allocation and subsequent out-of-bounds writes. Because exploitation requires a local user to open a malicious filesystem image, the attack is local and user-interaction dependent (CVSS 6.6), with primary impact to availability (A:H) through application crash, and potential for limited memory corruption. No public PoC or exploit code has been identified.

Technical Analysis

Parted is a command-line disk partitioning program that parses and manipulates filesystem metadata, including FAT32 volume structures, to resize, inspect, or modify partitions. This vulnerability resides in the FAT32 metadata processing path, where a buffer size is computed for a structure read from the filesystem image before allocation. An integer calculation error — likely in the multiplication or addition of size fields derived from on-disk FAT32 metadata (such as sector counts, cluster sizes, or FAT table dimensions) — causes the computed allocation size to wrap or be smaller than the actual data copied into it. The result is a classic heap overflow (CWE-787, Out-of-bounds Write): a write past the end of the allocated heap buffer.

The attack surface is the filesystem image parsing code executed by parted when a user or automated service invokes it against an untrusted image file. The CVSS vector reflects the access model: AV:L (local access to open the image), AC:L (no special conditions beyond supplying a crafted image), PR:N (no privileges required to invoke the parse), UI:R (a user or automated service must open the malicious image), S:U (impact confined to the parted process), C:L/I:L/A:H (limited confidentiality and integrity impact, high availability impact). The described consequence is a crash leading to Denial of Service, with "potential memory corruption" implying possible, though unconfirmed, code execution primitives.

Technical detail on the exact function, field names, and arithmetic expression involved is not available in the provided CNA/NVD text. The class-level mechanism — integer overflow in size calculation leading to heap buffer overflow during FAT32 metadata parsing — is the derivable root cause, and defenders should treat the parser as untrusted-input attack surface until a patch is published.

Exploitation Scenarios

No public PoC or exploit code is available; the following chain is inferred from the vulnerability class and the description.

1. Reconnaissance/target identification. An attacker identifies an environment where parted (or an automated service wrapping it, such as an image provisioning, forensics, or disk management pipeline) processes attacker-supplied filesystem images. This is a local vector (AV:L); the attacker must be able to place a malicious FAT32 image where a victim user or automated service will open it — for example via a shared directory, removable media, or a provisioning queue.

2. Triggering the flaw. The attacker crafts a FAT32 filesystem image in which on-disk size fields (e.g., FAT table geometry, cluster counts, or sector parameters) are chosen so that parted's allocation-size calculation overflows or underflows to a small value. When the victim or service runs parted against the image, the program computes the undersized buffer, allocates it, and then copies/writes more FAT32 metadata into it than the allocation permits, producing a heap out-of-bounds write.

3. Payload/execution method (class level). At minimum the malformed size relationship causes heap corruption detected by the allocator or via a segmentation fault, terminating parted (DoS). Where heap grooming is feasible, controlled overwrite of adjacent heap metadata could theoretically steer execution flow, but the description only confirms crash/DoS and "potential memory corruption" — no reliable code-execution path is established in the available data.

4. Post-exploitation impact. Primary outcome is denial of service against the victim's partitioning operation or the automated image-processing service, potentially disrupting provisioning or recovery workflows. Limited confidentiality/integrity impact (C:L/I:L) is consistent with partial memory corruption rather than full control of the process; any broader impact depends on the privileges of the process invoking parted and remains unproven.

Impact Assessment

Affected systems are Linux/Unix hosts and embedded/automation environments where parted is invoked against untrusted or third-party filesystem images — including disk-imaging pipelines, forensics tooling, CI/image-build systems, and any workflow that accepts FAT32 images from external sources. The CVSS 6.6 score is driven by high availability impact (A:H) — reliable crash/DoS — with low confidentiality (C:L) and integrity (I:L) impact from partial memory corruption. Scope is unchanged (S:U), so blast radius is bounded by the permissions of the process running parted: a crash of a privileged partitioning service can disrupt storage operations, while a user-context crash has minimal downstream effect. No evidence of active in-the-wild exploitation, no CISA KEV listing, and no EPSS score is available yet. Risk is highest for environments that automatically process externally sourced disk images.

Detection Guidance

Sigma Rule

title: Potential Exploitation of parted FAT32 Heap Overflow via Malicious Filesystem Image
id: 3f9c2a41-7b8e-4d16-9e2a-89085cve0001
status: experimental
description: Detects parted crashing or aborting while processing FAT32 images, consistent with CVE-2026-89085 heap-based buffer overflow triggered by crafted filesystem images.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89085
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1204
  - cve.2026.89085
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/parted'
  selection_args:
    CommandLine|contains:
      - '.img'
      - '.fat'
      - '.vfat'
      - '.iso'
  condition: selection_img and selection_args
fields:
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate administrative use of parted against image files
level: medium

YARA Rule

rule CVE_2026_89085_Parted_FAT32_Integer_Overflow_Image
{
    meta:
        description = "Flags FAT32 filesystem images with anomalous size fields potentially crafted to trigger CVE-2026-89085 in parted"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89085"
        cve = "CVE-2026-89085"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fat32_boot = { EB ?? 90 6D 6B 66 73 2E 46 41 54 33 32 }   // jmp + "mkfs.FAT32" OEM label
        $fat32_id   = { 46 41 54 33 32 }                            // "FAT32" filesystem type string

    condition:
        uint16(0) == 0x5A4D or true and
        (uint32(0x1FE) == 0xAA55) and
        $fat32_boot at 0x00 or
        ($fat32_boot at 0x00 and $fat32_id in (0x52..0x5A))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-89085 Potential Transfer of Crafted FAT32 Image Targeting parted"; flow:established,to_server; content:"|EB|"; depth:1; content:"|55 AA|"; offset:510; depth:2; content:"FAT32"; within:128; classtype:attempted-dos; sid:202689085; rev:1; metadata:affected_product parted, cve CVE-2026-89085, created_at 2026_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name == "parted" and
  process.args : ("*.img", "*.fat", "*.vfat", "*.ISO", "*.iso")

Splunk SPL Query

index=endpoint (sourcetype=linux_audit OR sourcetype=sysmon_linux OR sourcetype="WinEventLog:Security")
(process_name=parted OR process_path="*/parted" OR EXE="/usr/sbin/parted")
| search command_line="*.img*" OR command_line="*.fat*" OR command_line="*.vfat*" OR command_line="*mkfs*"
| table _time host user process_name command_line parent_process
| sort - _time

Wazuh OSSEC Rule

<group name="linux,parted,exploit,">
  <rule id="100985" level="8">
    <if_sid>550</if_sid>
    <field name="audit.exe">/parted$</field>
    <regex type="pcre2">\.(img|fat|vfat|iso)$</regex>
    <description>CVE-2026-89085: parted invoked on filesystem image; potential crafted FAT32 heap overflow attempt</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_89085,</group>
  </rule>
  <rule id="100986" level="10">
    <decoded_as>kernel</decoded_as>
    <match>parted.*(segfault|heap|corrupt)</match>
    <description>CVE-2026-89085: parted heap corruption or crash detected while parsing filesystem image</description>
    <group>cve_2026_89085,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is currently available.

1. Immediate mitigations. Treat FAT32 image parsing as untrusted input. Do not open filesystem images from untrusted or unverified sources with parted; enforce provenance checks (hash verification, signature validation) before processing images in automated pipelines. Where practical, run parted inside a restricted, non-privileged sandbox or container with seccomp/AppArmor/SELinux confinement and no access to critical block devices, so that a heap corruption or crash is contained. Monitor for crashes (segfaults, allocator abort messages) in parted-driven workflows and alert on repeated malformed-image processing.

2. Patch/upgrade steps. No patch is available from tracked sources. Monitor the GNU parted project, distribution security trackers (e.g., Debian, Ubuntu, Red Hat advisories), and the NVD entry for CVE-2026-89085 for a fixed version. Once released, upgrade parted via the distribution package manager and verify package versions in image-processing endpoints and build systems.

3. Long-term hardening. Minimize the set of hosts and accounts that invoke parted; prefer offline/in-guest processing for third-party disk images; integrate fuzzing (AFL++/libFuzzer) of filesystem parsers into CI for any in-house tooling that embeds parted; and maintain defense-in-depth (least privilege, sandboxing, EDR monitoring of image-processing services). Because the vulnerability involves integer calculations during buffer allocation, input size validation and hardened allocators (e.g., jemalloc/glibc MALLOC_CHECK) add transient detection value while a fix is pending.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-89085
• GNU parted project (upstream source and release notes): https://www.gnu.org/software/parted/
• CWE-787 Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, or public PoC/exploit code for CVE-2026-89085 have been identified in available sources.