CVE-2026-42618
MediumSummary
In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_decompress() in compress.c allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image and reading a specially crafted file.
Risk Assessment
The risk involves potential local privilege escalation or system destabilization through heap memory corruption in a process with elevated privileges (SUID root).
Recommendation
Immediately update NTFS-3G to a version later than 2026.2.25 and avoid mounting untrusted NTFS images until the patch is applied.
Original NVD description (English source)
In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.