CVE-2026-42616
MediumSummary
In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the cat() function in cat.c. An attacker can exploit this by crafting a malicious NTFS image that, when a file is read, corrupts heap memory in the ntfscat binary.
Risk Assessment
The risk includes potential remote code execution or system crash by delivering a crafted NTFS image to a user. Organizations using NTFS-3G to mount untrusted volumes are exposed to integrity and availability breaches.
Recommendation
Immediately update NTFS-3G to a version later than 2026.2.25 once a patch is released. Until then, avoid mounting NTFS images from untrusted sources.
Original NVD description (English source)
In NTFS-3G through 2026.2.25, a heap buffer overflow exists in cat() in cat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.