Tuxera vulnerabilities

CVE-2026-46570 High · 8.1 CWE-122 Oct 7, 2026

Heap-based Buffer Overflow in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.

CVE-2026-46572 High · 7.4 CWE-122 Oct 7, 2026

Heap-based Buffer Overflow in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.

CVE-2026-46571 Medium · 5.5 CWE-125 Oct 7, 2026

Out-of-bounds Read in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

CVE-2026-46569 High · 7.7 CWE-787 Oct 7, 2026

Out-of-bounds Write in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

CVE-2026-42618 High · 7.1 CWE-122 Oct 7, 2026

Heap-based Buffer Overflow in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.

CVE-2026-42617 High · 7.1 CWE-122 Oct 7, 2026

Heap-based Buffer Overflow in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

CVE-2026-42616 High · 7.8 CWE-787 Oct 7, 2026

Out-of-bounds Write in Tuxera Ntfs-3g

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.

CVE-2026-56136 Medium · 4.7 CWE-125 Aug 24, 2026

Out-of-bounds Read in Tuxera Ntfs-3g

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.

CVE-2026-56135 High · 7.4 CWE-122 Aug 24, 2026

Heap-based Buffer Overflow in Tuxera Ntfs-3g

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

CVE-2026-40706 High · 8.4 CWE-122 Apr 21, 2026

Heap-based Buffer Overflow in Tuxera Ntfs-3g

In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.