The NTFS-3G package, version 2026.7.7, has been released. It includes a free user-space driver using the FUSE mechanism and the ntfsprogs utility suite for manipulating NTFS partitions. The project's code is distributed under the GPLv2 license. The new version fixes nine vulnerabilities that could lead to code execution with root privileges when processing specially formatted partitions or disk images with NTFS.
- CVE-2026-46569 — A buffer overflow in the ntfs_ib_copy_tail() function caused by a lack of valid range checking. This vulnerability can lead to root code execution by creating a file in a specially crafted directory after mounting an attacker-modified NTFS image.
- CVE-2026-42617 - A buffer overflow in the ntfs_ir_to_ib() function can lead to code execution with root privileges by creating a file in a directory after mounting a specially modified NTFS image.
- CVE-2026-42618 – A buffer overflow in the ntfs_decompress() function can lead to code execution with root privileges when reading a specially crafted file after mounting an attacker-modified NTFS image.
- CVE-2026-46570 - A buffer overflow in the ntfs_index_walk_down() function can lead to code execution with root privileges when accessing file metadata after mounting a specially crafted NTFS image.
- CVE-2026-46572 - A buffer overflow in the ntfs_ib_cut_tail() function can lead to code execution with root privileges when creating a file in a directory after mounting a specially crafted NTFS image with a corrupted index.
- CVE-2026-56135 - A buffer overflow in the build_inherited_id() function could lead to code execution with root privileges when creating a file after mounting a specially crafted NTFS image with incorrect directory ACL metadata.
- CVE-2026-42616 – A buffer overflow in the ntfscat utility could potentially lead to code execution when reading specially crafted NTFS images.
- CVE-2026-46571, CVE-2026-56136 – Out-of-bounds read vulnerability during symbolic link parsing and file manipulation after mounting an attacker-modified NTFS image. These vulnerabilities may lead to an information leak from the memory of a privileged ntfs-3g process.
Source: opennet.ru
