CVE-2026-42617

Analyzed Analyzed - Analysis Complete

Heap Buffer Overflow in NTFS-3G

Publication date: 2026-10-07

Last updated on: 2026-10-08

Assigner: MITRE

Description

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-42617

EUVD

EUVD-2026-94355

Affected Vendors & Products

Vendor	Product	Version / Range
tuxera	ntfs-3g	to 2026.7.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2026-42617 is a heap buffer overflow in the ntfs_ir_to_ib() function of the NTFS-3G filesystem driver. It occurs when a directory is extended, such as by creating a file, and allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by using a malicious NTFS image.

Detection Guidance

Detecting this vulnerability requires checking the installed version of NTFS-3G. Run 'ntfs-3g --version' to verify if your version is 2026.2.25 or earlier. If so, the system is vulnerable. Additionally, monitor for suspicious activity like unexpected directory extensions or file creations on NTFS volumes.

Impact Analysis

This vulnerability can lead to high confidentiality, integrity, and availability losses on the affected system. Since the ntfs-3g binary runs with SUID-root privileges, an attacker could potentially gain root access or cause system crashes by exploiting the heap corruption.

Compliance Impact

This vulnerability could lead to high confidentiality, integrity, and availability losses on the vulnerable system, which may result in unauthorized access or data corruption. Such impacts could potentially violate compliance requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., integrity of protected health information).

Mitigation Strategies

Immediately update NTFS-3G to version 2026.7.7 or later. If updating is not possible, avoid mounting untrusted NTFS images and restrict access to the ntfs-3g binary. Disable SUID-root privileges for ntfs-3g if feasible until patched.

Hi! I’m here to help you understand CVE-2026-42617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70