CVE-2026-46569GHSA-xxv8-9r24-hcj9
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a ma
n/a n/a
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2026.7.7ntfs-3g, fuseGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
Text from CVE List
Affected versions 2
- n/aaffected: n/aCVE List
- ntfs-3g, fuse2026.2.25 and earlierGitHub