Skip to main content

NTFS-3G CVE-2026-42617

MEDIUM
2026-07-15 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
8.8 HIGH

Local vector via SUID-root binary; low privileges since any local user invokes ntfs-3g; scope changes to root via SUID escalation path.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Lifecycle Timeline

2
Analysis Generated
Jul 16, 2026 - 16:35 vuln.today
CVE Published
Jul 15, 2026 - 00:00 cve.org
MEDIUM

DescriptionCVE.org

In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

AnalysisAI

Heap buffer overflow in NTFS-3G through 2026.2.25 allows a local attacker to corrupt heap memory in the SUID-root ntfs-3g binary by mounting a crafted NTFS image and performing a directory-extending operation such as creating a file. Because ntfs-3g runs as root via the SUID bit on most Linux distributions, successful exploitation of the overflow in ntfs_ir_to_ib() could yield local privilege escalation to root. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available via Ubuntu Security Notice USN-8554-1.

Technical ContextAI

NTFS-3G is an open-source FUSE (Filesystem in Userspace) driver that provides read/write NTFS access on Linux and other UNIX-like systems. It is shipped as a SUID-root binary by default on Ubuntu and most Debian-based distributions so that unprivileged users can mount NTFS volumes without elevated credentials. The vulnerability resides in ntfs_ir_to_ib() in index.c, the function responsible for converting an in-memory index root - the B-tree root node that tracks directory entries - into an on-disk index allocation block when a directory must grow beyond its root capacity. A crafted NTFS image can supply malformed index metadata that causes this conversion to write beyond the bounds of the allocated heap buffer, overwriting adjacent heap structures. Because the overflow occurs inside the root-privileged ntfs-3g process, heap corruption operates with root context. No CWE was formally assigned in the source data, but this is a canonical CWE-122 (Heap-based Buffer Overflow) pattern. Affected versions are confirmed through 2026.2.25; no CPE strings were provided in the source intelligence.

Affected ProductsAI

NTFS-3G through version 2026.2.25 is confirmed affected per the CVE description and Ubuntu Security Notice USN-8554-1 (https://ubuntu.com/security/notices/USN-8554-1). No CPE strings were provided in the source intelligence; the lower version bound of the affected range is not stated in available data. Ubuntu packages are addressed by USN-8554-1; other distributions that ship ntfs-3g - including Debian, Fedora, RHEL, openSUSE, and Alpine - should be considered affected at corresponding upstream versions and users should check their distribution's security advisories for patched package versions. The vulnerability specifically affects deployments where the ntfs-3g binary carries the SUID-root bit, which is the default installation mode on most distributions.

RemediationAI

Upgrade ntfs-3g to a version beyond 2026.2.25; Ubuntu users should apply the updated package per USN-8554-1 at https://ubuntu.com/security/notices/USN-8554-1 by running apt-get update followed by apt-get upgrade ntfs-3g and verifying the installed version exceeds the affected range. Users on other distributions should monitor their distribution's security channels for equivalent updates. If immediate patching is not feasible, the most targeted compensating control is to remove the SUID bit from the ntfs-3g binary (chmod u-s /usr/bin/ntfs-3g or the equivalent path); this prevents unprivileged users from invoking ntfs-3g directly and blocks the exploitation path, but has the trade-off of requiring root or sudo for all NTFS mount operations, which will break desktop automount workflows for regular users. A secondary control is to restrict NTFS automount policy via polkit or udev rules so only trusted, enumerated users can trigger mounts. Avoid mounting NTFS images or media from untrusted sources - unknown USB drives, downloaded disk images - until the patch is applied.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-42617 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy