NTFS-3G vulnerabilities

In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_fix_file_name() function in libntfs-3g/reparse.c. An attacker can exploit this by crafting a malicious NTFS image, leading to the disclosure of confidential information from ntfs-3g process memory when a readlink is performed on a corrupted reparse point.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ir_to_ib() function in index.c. An attacker can exploit this by crafting a malicious NTFS image that, when mounted and a directory is extended (e.g., by creating a file), corrupts heap memory in the SUID-root ntfs-3g binary.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_decompress() in compress.c allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image and reading a specially crafted file.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_cut_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_copy_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the cat() function in cat.c. An attacker can exploit this by crafting a malicious NTFS image that, when a file is read, corrupts heap memory in the ntfscat binary.

In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_ir_nill() function in libntfs-3g/index.c. An attacker can exploit this by crafting a malicious NTFS image containing a file with a specially crafted name, leading to the disclosure of potentially confidential information from the ntfs-3g process memory.

NTFS-3G through 2026.2.25 has a heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c, allowing an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

In NTFS-3G versions prior to 2021.8.22, a stack buffer overflow occurs when correcting differences between the MFT and MFTMirror. This can lead to code execution or privilege escalation when running with setuid-root.

In NTFS-3G versions prior to 2021.8.22, supplying a specially crafted NTFS inode pathname in an NTFS image can cause a heap buffer overflow, resulting in memory disclosure, denial of service, and even code execution.

In NTFS-3G versions prior to 2021.8.22, a heap buffer overflow vulnerability exists when reading specially crafted NTFS attributes in the ntfs_attr_pread_i function. This can lead to arbitrary memory write or denial of service.

In NTFS-3G versions prior to 2021.8.22, a specially crafted Unicode string in an NTFS image can cause a heap buffer overflow, allowing arbitrary code execution.

In NTFS-3G versions prior to 2021.8.22, a heap buffer overflow vulnerability exists in the ntfs_attr_setup_flag function when processing a specially crafted NTFS attribute from the MFT. This can lead to arbitrary code execution and privilege escalation.

In NTFS-3G versions prior to 2021.8.22, loading a specially crafted NTFS inode in the ntfs_inode_real_open function can trigger a heap buffer overflow, allowing code execution and privilege escalation.

In NTFS-3G versions prior to 2021.8.22, a heap buffer overflow can occur when processing a specially crafted MFT section in an NTFS image, allowing code execution.