Out-of-bounds memory read in NTFS-3G through 2026.2.25 exposes ntfs-3g process memory contents when a victim mounts a crafted NTFS filesystem image and invokes readlink on a corrupted reparse point file. The defect resides in ntfs_fix_file_name() within libntfs-3g/reparse.c and can disclose potentially confidential in-process data - such as recently processed file paths or runtime buffers - to the attacker who supplied the malicious image. No public exploit has been identified at time of analysis; Ubuntu has confirmed patch availability via security advisory USN-8554-1.
Heap buffer overflow in NTFS-3G through 2026.2.25 allows a local attacker to corrupt heap memory in the SUID-root ntfs-3g binary by mounting a crafted NTFS image and performing a directory-extending operation such as creating a file. Because ntfs-3g runs as root via the SUID bit on most Linux distributions, successful exploitation of the overflow in ntfs_ir_to_ib() could yield local privilege escalation to root. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available via Ubuntu Security Notice USN-8554-1.
Heap buffer overflow in NTFS-3G's ntfscat utility (versions through 2026.2.25) enables heap memory corruption when processing a crafted malicious NTFS image, specifically in the cat() function of cat.c. The overflow is triggered passively during file read operations, requiring no complex interaction beyond ntfscat processing an attacker-supplied image. No public exploit has been identified at time of analysis, and a vendor patch is available via Ubuntu USN-8554-1. Given NTFS-3G's near-universal deployment across Linux distributions, organizations that process untrusted disk images - forensic tools, backup pipelines, virtualization stacks - face meaningful exposure until patched.
Heap buffer overflow in NTFS-3G through 2026.2.25 allows local privilege escalation to root via a crafted NTFS filesystem image. The overflow occurs in ntfs_ib_cut_tail() within the index management code when a file is created inside a specially constructed directory on a malicious NTFS image. Because the ntfs-3g binary runs as SUID-root, heap corruption in this process can yield code execution with root privileges. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Heap buffer overflow in NTFS-3G through 2026.2.25 allows a local attacker to corrupt heap memory in the SUID-root ntfs-3g binary by supplying a crafted NTFS image, with exploitation triggered when a directory is extended (e.g., a file is created) on the mounted filesystem. Because ntfs-3g carries the SUID-root bit to operate FUSE-based NTFS mounts, successful heap corruption in this context carries privilege escalation potential to root. No public exploit code has been identified at time of analysis; a vendor-released patch is available via Ubuntu USN-8554-1.
Heap buffer overflow in NTFS-3G through 2026.2.25 allows a local attacker to corrupt heap memory in the SUID-root ntfs-3g binary by supplying a crafted NTFS filesystem image, potentially achieving privilege escalation to root. The flaw resides in the index B-tree traversal function ntfs_index_walk_down() in libntfs-3g/index.c and is triggered during parsing of crafted file metadata. No public exploit code has been identified at time of analysis, but Ubuntu has issued a security advisory (USN-8554-1) and a vendor patch is available.