The NTFS-3G 2026.7.7 package release has been published, which includes a free driver that operates in user space using the FUSE mechanism, and a set of tools called ntfsprogs for manipulating NTFS partitions. The project's code is distributed under the GPLv2 license. The new version addresses 9 vulnerabilities that could lead to code execution with root privileges when handling specially crafted NTFS file systems or disk images.
- CVE-2026-46569 — Buffer overflow in the function ntfs_ib_copy_tail(), caused by the lack of validation for an acceptable range of values. The vulnerability could lead to code execution with root privileges by creating a file in a specially crafted directory after mounting a modified attacker image of NTFS.
- CVE-2026-42617 — Buffer overflow in the function ntfs_ir_to_ib(), which could lead to code execution with root privileges by creating a file in a directory after mounting a specially modified NTFS image.
- CVE-2026-42618 — Buffer overflow in the function ntfs_decompress(), which could lead to code execution with root privileges when reading a specially crafted file after mounting a modified attacker image of NTFS.
- CVE-2026-46570 — Buffer overflow in the function ntfs_index_walk_down(), which could lead to code execution with root privileges when accessing file metadata after mounting a specially crafted NTFS image.
- CVE-2026-46572 — Buffer overflow in the function ntfs_ib_cut_tail(), which could lead to code execution with root privileges when creating a file in a directory after mounting a specially crafted NTFS image with a corrupted index.
- CVE-2026-56135 — Buffer overflow in the function build_inherited_id(), which could lead to code execution with root privileges when creating a file after mounting a specially crafted NTFS image with incorrect ACL metadata in the directory.
- CVE-2026-42616 — Buffer overflow in the ntfscat utility, which could potentially lead to code execution when reading specially crafted NTFS images.
- CVE-2026-46571, CVE-2026-56136 — reading from outside the allocated buffer when parsing symbolic links and manipulating files after mounting a modified attacker's NTFS image. The vulnerabilities may lead to information leakage from the memory of the privileged process ntfs-3g.
Source: opennet.ru
