Skip to main content

NTFS-3G CVE-2026-42616

MEDIUM
2026-07-15 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
7.8 HIGH

Local vector because exploitation requires processing a crafted image file; no privileges needed but user must invoke ntfscat; heap corruption enables full CIA impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Lifecycle Timeline

2
Analysis Generated
Jul 16, 2026 - 16:36 vuln.today
CVE Published
Jul 15, 2026 - 00:00 cve.org
MEDIUM

DescriptionCVE.org

In NTFS-3G through 2026.2.25, a heap buffer overflow exists in cat() in cat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.

AnalysisAI

Heap buffer overflow in NTFS-3G's ntfscat utility (versions through 2026.2.25) enables heap memory corruption when processing a crafted malicious NTFS image, specifically in the cat() function of cat.c. The overflow is triggered passively during file read operations, requiring no complex interaction beyond ntfscat processing an attacker-supplied image. No public exploit has been identified at time of analysis, and a vendor patch is available via Ubuntu USN-8554-1. Given NTFS-3G's near-universal deployment across Linux distributions, organizations that process untrusted disk images - forensic tools, backup pipelines, virtualization stacks - face meaningful exposure until patched.

Technical ContextAI

NTFS-3G is an open-source FUSE-based NTFS driver providing read/write access to Microsoft NTFS filesystems on Linux, macOS, and other non-Windows platforms. It ships by default in virtually every major Linux distribution and is the standard mechanism for accessing NTFS volumes outside Windows. The ntfscat binary is a utility within the NTFS-3G toolset that reads and outputs the contents of files stored on NTFS volumes, functioning analogously to the Unix cat command but operating against raw NTFS images. The root cause is a classic heap-based buffer overflow (CWE-122): the cat() function in cat.c performs insufficient bounds validation when reading file content from a crafted NTFS image, allowing attacker-controlled data to write past the end of an allocated heap buffer, corrupting adjacent heap metadata or object data. No CWE was formally assigned in the source data; CWE-122 is inferred from the description.

Affected ProductsAI

NTFS-3G through version 2026.2.25 is confirmed affected, specifically the ntfscat binary within the NTFS-3G toolset. This encompasses all Linux distributions shipping NTFS-3G at or below this version, with Ubuntu explicitly confirmed as an affected platform per USN-8554-1 (https://ubuntu.com/security/notices/USN-8554-1). No CPE string was provided in the source data; the canonical identifier would be cpe:2.3:a:tuxera:ntfs-3g:*:*:*:*:*:*:*:* for versions up to and including 2026.2.25. Other distributions shipping NTFS-3G (Debian, Fedora, Arch, RHEL-adjacent) should be considered potentially affected pending their own advisories.

RemediationAI

A patch is available per the vendor advisory. Ubuntu users should apply the update referenced in USN-8554-1 at https://ubuntu.com/security/notices/USN-8554-1 using standard package manager commands (apt update && apt upgrade ntfs-3g). The exact upstream fixed version is not independently confirmed from the available input data - verify the specific patched release in the Ubuntu advisory or the upstream NTFS-3G changelog before assuming a particular version is safe. As compensating controls where immediate patching is not feasible: restrict execution of the ntfscat binary via filesystem permissions or AppArmor/SELinux profiles to limit which users or processes can invoke it; in automated disk-image processing pipelines, sandbox ntfscat within a seccomp-restricted container or low-privilege user with no access to sensitive data, limiting the blast radius of heap corruption. Note that restricting ntfscat does not protect against vulnerabilities in other NTFS-3G components such as the kernel FUSE driver or ntfsmount.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-42616 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy