Skip to main content

NTFS-3G CVE-2026-42618

MEDIUM
2026-07-15 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
8.1 HIGH

Local SUID binary invocable by any unprivileged user (AV:L, PR:N); single-byte heap overflow demands complex heap shaping (AC:H); SUID-root escalation changes execution scope (S:C) enabling full system compromise.

3.1 AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Lifecycle Timeline

1
Analysis Generated
Jul 16, 2026 - 16:35 vuln.today

DescriptionCVE.org

In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.

AnalysisAI

Heap buffer overflow in NTFS-3G through 2026.2.25 allows a local attacker to corrupt one byte of heap memory within the SUID-root ntfs-3g binary by supplying a specially crafted NTFS image, triggering the flaw during decompression in ntfs_decompress() in compress.c. Because the binary executes with root privileges via the SUID mechanism, successful heap exploitation could yield full local privilege escalation to root from an unprivileged account. No public exploit has been identified at time of analysis, and the single-byte overflow constraint substantially raises exploitation complexity, but the SUID-root execution context makes this a high-value local privilege escalation target.

Technical ContextAI

NTFS-3G is a FUSE (Filesystem in Userspace) implementation of the NTFS filesystem driver, widely installed on Linux and other Unix-like systems to provide read/write access to Windows NTFS volumes. The vulnerable code path is ntfs_decompress() in compress.c, responsible for decompressing NTFS compressed data streams - a complex parsing path that processes attacker-influenced filesystem structures. A heap buffer overflow in this function allows corruption of one byte of heap memory, consistent with an off-by-one or boundary condition error (CWE-122, Heap-based Buffer Overflow, though no CWE was explicitly provided in the source data). The binary is typically installed SUID-root on Linux distributions so that unprivileged users can mount NTFS volumes, meaning the vulnerable code executes in a root-privileged process context regardless of the invoking user's privileges. No CPE strings were supplied; the affected product is identified as ntfs-3g through version 2026.2.25.

Affected ProductsAI

NTFS-3G through version 2026.2.25 is confirmed affected by this heap buffer overflow. The vulnerability is exploitable on any platform where the ntfs-3g binary is installed with the SUID-root bit set, which is the standard deployment on most Linux distributions including Ubuntu, Debian, Fedora, and derivatives. Ubuntu has issued Security Notice USN-8554-1 (https://ubuntu.com/security/notices/USN-8554-1) confirming the issue. No CPE strings or explicit version lower-bound were provided; the affected range is defined in the CVE description as 'through 2026.2.25' with no stated lower bound, implying all prior releases are also vulnerable.

RemediationAI

Patch available per vendor advisory - upgrade ntfs-3g to a version beyond 2026.2.25 using your distribution's package manager. Ubuntu users should apply the update referenced in USN-8554-1 (https://ubuntu.com/security/notices/USN-8554-1); the exact patched package version is not independently confirmed from the available data and should be verified against the Ubuntu security repository. As a compensating control pending patching, administrators can remove the SUID bit from the ntfs-3g binary with 'chmod u-s /usr/bin/ntfs-3g', which eliminates the privilege escalation risk but prevents unprivileged users from mounting NTFS volumes - a significant trade-off on desktop or multi-user systems where NTFS access is needed. Disabling automount of external NTFS devices reduces the attack surface by limiting attacker-controlled image ingestion. Restricting physical access to USB ports or enforcing device control policies further limits the ability to introduce crafted NTFS images.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-42618 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy