Mtools, a utility suite for accessing MS-DOS disks on GNU and Unix systems, has a security vulnerability (CVE-2026-118384) involving an out-of-bounds write in the parse_vses function within vfat.c. This flaw affects versions prior to 4.0.35-3.oe2203sp4 and can lead to a denial of service due to application crash. A fix is available in version 4.0.35-3.oe2203sp4.