Tuxera ntfs-3g 2021.8.22/2022.10.3/2026.2.25 NTFS image index.c ntfs_ir_to_ib heap-based overflow

Summaryinfo

A vulnerability described as very critical has been identified in Tuxera ntfs-3g. This vulnerability affects the function ntfs_ir_to_ib of the file index.c of the component NTFS image Handler. Executing a manipulation can lead to heap-based overflow. This vulnerability is registered as CVE-2026-42617. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as very critical was found in Tuxera ntfs-3g. This vulnerability affects the function ntfs_ir_to_ib of the file index.c of the component NTFS image Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-42617 since 04/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/07/2026).

Upgrading to version 2026.7.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-94355). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Tuxera

Name

• ntfs-3g

Version

• 2021.8.22
• 2022.10.3
• 2026.2.25

License

• open-source

Website

• Product: https://github.com/tuxera/ntfs-3g/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion