{"id":"CVE-2026-91041","title":"FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image","summary":"Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_M…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787","CWE-1284"],"vendor":"Eclipse Foundation","product":"FileX","affected":["FileX <= 6.5.1.202602"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-20T15:29:42.506041Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:30:22.550Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91041","references":[{"url":"https://github.com/eclipse-threadx/filex/security/advisories/GHSA-c8cj-fj9j-426v"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T14:08:00.578Z","slug":"CVE-2026-91041","body":"## Overview\n\nMounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.\n\n## Affected\n\n- `FileX <= 6.5.1.202602`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}