CVE-2026-46571
MediumSummary
In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_fix_file_name() function in libntfs-3g/reparse.c. An attacker can exploit this by crafting a malicious NTFS image, leading to the disclosure of confidential information from ntfs-3g process memory when a readlink is performed on a corrupted reparse point.
Risk Assessment
The risk involves potential leakage of confidential data from ntfs-3g process memory, which could expose sensitive information such as passwords or cryptographic keys to an attacker via a crafted NTFS image.
Recommendation
It is recommended to immediately update NTFS-3G to a version later than 2026.2.25, which includes a fix for this vulnerability. Additionally, avoid mounting untrusted NTFS images until the update is applied.
Original NVD description (English source)
In NTFS-3G through 2026.2.25, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted f