CVE-2026-46571

EUVD-2026-94353
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.36%
Affected Products (NVD)
VendorProductVersion
tuxerantfs-3g
𝑥
< 2026.7.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ntfs-3g
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1:2026.7.7-2
fixed
sid
1:2026.7.7-2
fixed
trixie
1:2022.10.3-5+deb13u2
fixed
trixie (security)
1:2022.10.3-5+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ntfs-3g
bionic
needs-triage
focal
needs-triage
jammy
Fixed 1:2021.8.22-3ubuntu1.4
released
noble
Fixed 1:2022.10.3-1.2ubuntu3.2
released
resolute
Fixed 1:2022.10.3-5ubuntu1.1
released
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libntfs-3g-devel
suse enterprise sap 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP6
2022.5.17-150000.3.27.1
fixed
libntfs-3g87
suse enterprise desktop 15 SP7
2022.5.17-150000.3.27.1
fixed
suse enterprise sap 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise sap 15 SP7
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP7
2022.5.17-150000.3.27.1
fixed
ntfs-3g
suse enterprise desktop 15 SP7
2022.5.17-150000.3.27.1
fixed
suse enterprise sap 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise sap 15 SP7
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP7
2022.5.17-150000.3.27.1
fixed
ntfsprogs
suse enterprise desktop 15 SP7
2022.5.17-150000.3.27.1
fixed
suse enterprise sap 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise sap 15 SP7
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP6
2022.5.17-150000.3.27.1
fixed
suse enterprise server 15 SP7
2022.5.17-150000.3.27.1
fixed
Common Weakness Enumeration
References
https://github.com/tuxera/ntfs-3g/releases#release-2026.7.7
https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-52gr-j4pv-9pjh