CVE-2026-42617
MediumSummary
In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ir_to_ib() function in index.c. An attacker can exploit this by crafting a malicious NTFS image that, when mounted and a directory is extended (e.g., by creating a file), corrupts heap memory in the SUID-root ntfs-3g binary.
Risk Assessment
The risk is potential local privilege escalation or arbitrary code execution in the root context, as the vulnerable binary runs with elevated privileges. The attack requires system access and the ability to mount a crafted NTFS image.
Recommendation
Immediately update NTFS-3G to a version newer than 2026.2.25 once a patch is available. Until then, avoid mounting NTFS images from untrusted sources and consider temporarily removing the SUID bit from the ntfs-3g binary.
Other vulnerabilities in NTFS-3G
See all- CVE-2026-46571Medium
In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_fix_file_name() function in libntfs-3g/reparse.c. An attacker can exploit this by crafting a malicious NTFS image, leading to the disclosure of confidential information from ntfs-3g process memory when a readlink is performed on a corrupted reparse point.
- CVE-2026-42616Medium
In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the cat() function in cat.c. An attacker can exploit this by crafting a malicious NTFS image that, when a file is read, corrupts heap memory in the ntfscat binary.
- CVE-2026-42618Medium
In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_decompress() in compress.c allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image and reading a specially crafted file.
- CVE-2026-46572Medium
In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_cut_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.
- CVE-2026-46569Medium
In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_copy_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.
- CVE-2026-46570Medium
In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.
- CVE-2026-56136Medium
In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_ir_nill() function in libntfs-3g/index.c. An attacker can exploit this by crafting a malicious NTFS image containing a file with a specially crafted name, leading to the disclosure of potentially confidential information from the ntfs-3g process memory.
- CVE-2026-56135High
NTFS-3G through 2026.2.25 has a heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c, allowing an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.
- CVE-2021-35267High
In NTFS-3G versions prior to 2021.8.22, a stack buffer overflow occurs when correcting differences between the MFT and MFTMirror. This can lead to code execution or privilege escalation when running with setuid-root.
- CVE-2021-35266High
In NTFS-3G versions prior to 2021.8.22, supplying a specially crafted NTFS inode pathname in an NTFS image can cause a heap buffer overflow, resulting in memory disclosure, denial of service, and even code execution.
Original NVD description (English source)
In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS