Heap Buffer Overflow in NTFS-3G

Executive Summary

CVE-2026-42617 is a heap buffer overflow in the ntfs_ir_to_ib() function of the NTFS-3G filesystem driver. It occurs when a directory is extended, such as by creating a file, and allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by using a malicious NTFS image.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the installed version of NTFS-3G. Run 'ntfs-3g --version' to verify if your version is 2026.2.25 or earlier. If so, the system is vulnerable. Additionally, monitor for suspicious activity like unexpected directory extensions or file creations on NTFS volumes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to high confidentiality, integrity, and availability losses on the affected system. Since the ntfs-3g binary runs with SUID-root privileges, an attacker could potentially gain root access or cause system crashes by exploiting the heap corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to high confidentiality, integrity, and availability losses on the vulnerable system, which may result in unauthorized access or data corruption. Such impacts could potentially violate compliance requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., integrity of protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NTFS-3G to version 2026.7.7 or later. If updating is not possible, avoid mounting untrusted NTFS images and restrict access to the ntfs-3g binary. Disable SUID-root privileges for ntfs-3g if feasible until patched.

Useful 0 Not Useful 0