ALAS2023-2026-3189

References: CVE-2026-89085  CVE-2026-89088 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

heap buffer overflow in _init_fats / fat_table_read

NOTE: https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html (CVE-2026-89085)

heap buffer overflow in duplicate_legacy_root_dir

NOTE: https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html (CVE-2026-89088)

Issue Correction:
Run dnf update parted --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3189 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    parted-debuginfo-3.4-2.amzn2023.0.3.aarch64
    parted-devel-3.4-2.amzn2023.0.3.aarch64
    parted-3.4-2.amzn2023.0.3.aarch64
    parted-debugsource-3.4-2.amzn2023.0.3.aarch64

src:
    parted-3.4-2.amzn2023.0.3.src

x86_64:
    parted-devel-3.4-2.amzn2023.0.3.x86_64
    parted-debuginfo-3.4-2.amzn2023.0.3.x86_64
    parted-3.4-2.amzn2023.0.3.x86_64
    parted-debugsource-3.4-2.amzn2023.0.3.x86_64