Executive brief
NTFS-3G is an open-source driver that enables Linux systems to read and write NTFS filesystems (commonly found on Windows drives). An attacker can craft a malicious NTFS disk image that, when mounted or accessed by NTFS-3G, triggers an out-of-bounds memory read. This allows the attacker to read sensitive information from the NTFS-3G process, such as encryption keys or other confidential data in memory.
Technical details
This vulnerability is an out-of-bounds read in the ntfs_ir_nill() function within libntfs-3g/index.c. The flaw is triggered when NTFS-3G processes a file with a specially crafted name on a malicious NTFS disk image. The vulnerability requires local access and a user to mount or interact with the malicious filesystem. An attacker can read arbitrary data from the NTFS-3G process memory without authentication. The issue has been patched in version 2026.7.7, with backports available for earlier versions including 2022.10.3.
Affected products
- Tuxera NTFS-3G through 2026.2.25
Timeline
- 2026-07-15: disclosed
- 2026-07-07: patched: Version 2026.7.7 released