Skip to main content

NTFS-3G CVE-2026-46571

MEDIUM
2026-07-15 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
3.3 LOW

Requires local mounting of a crafted image and user-initiated readlink; impact is limited to low-severity memory read within ntfs-3g process with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from SUSE.

Lifecycle Timeline

2
Analysis Generated
Jul 16, 2026 - 16:33 vuln.today
CVE Published
Jul 15, 2026 - 00:00 cve.org
MEDIUM

DescriptionCVE.org

In NTFS-3G through 2026.2.25, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

AnalysisAI

Out-of-bounds memory read in NTFS-3G through 2026.2.25 exposes ntfs-3g process memory contents when a victim mounts a crafted NTFS filesystem image and invokes readlink on a corrupted reparse point file. The defect resides in ntfs_fix_file_name() within libntfs-3g/reparse.c and can disclose potentially confidential in-process data - such as recently processed file paths or runtime buffers - to the attacker who supplied the malicious image. No public exploit has been identified at time of analysis; Ubuntu has confirmed patch availability via security advisory USN-8554-1.

Technical ContextAI

NTFS-3G is an open-source, FUSE-based driver that provides read/write access to NTFS (New Technology File System) volumes on Linux, macOS, and other Unix-like operating systems. The vulnerable code path is in libntfs-3g/reparse.c, specifically ntfs_fix_file_name(), a function responsible for processing NTFS reparse point metadata. Reparse points are NTFS filesystem objects used to implement symbolic links, directory junction points, and volume mount points. When readlink() is issued against a file containing malformed reparse point data in a crafted NTFS image, ntfs_fix_file_name() reads beyond the legitimate bounds of its input buffer - a classic out-of-bounds read condition (analogous to CWE-125). No CWE tag was provided in the input data, but the description unambiguously describes this class. No CPE string was supplied; the affected component is the libntfs-3g shared library bundled with ntfs-3g through version 2026.2.25.

Affected ProductsAI

NTFS-3G versions through 2026.2.25 are confirmed affected via the libntfs-3g library component, as stated in the CVE description. Ubuntu has issued Security Notice USN-8554-1 (https://ubuntu.com/security/notices/USN-8554-1) covering this issue for Ubuntu-packaged ntfs-3g. No CPE string was provided in the input data. Other Linux distributions and macOS environments packaging ntfs-3g at or below version 2026.2.25 should be treated as potentially affected and assessed against their distribution-specific package advisories.

RemediationAI

Apply the vendor-released patch documented in Ubuntu Security Notice USN-8554-1 (https://ubuntu.com/security/notices/USN-8554-1); Ubuntu users should update the ntfs-3g package via apt. The exact upstream fixed release version was not specified in available references - verify the patched version against your distribution's package changelog before confirming remediation. For systems where immediate patching is not possible, disable automatic mounting of untrusted or removable NTFS volumes via udev rules or PAM mount restrictions; this prevents the malicious image from reaching the vulnerable code path but will impact users who legitimately mount external NTFS drives. Restricting ntfs-3g execution to privileged users only (removing the setuid bit or tightening FUSE group membership) reduces the unprivileged attack surface at the cost of requiring administrative intervention for every mount operation. Forensic and file-analysis tools that auto-process NTFS images should be patched as a priority given their routine handling of untrusted media.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-46571 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy