CVE-2026-42617: Buffer Overflow
Published Oct 7, 2026
·Updated
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsirtoib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
Affected Software
2 affected componentsFixes available
debian/ntfs-3g<=1:2017.3.23AR.3-4+deb11u4, <=1:2017.3.23AR.3-4+deb11u5, <=1:2022.10.3-1+deb12u3, <=1:2022.10.3-5+deb13u1, <=1:2026.2.25-1
1:2022.10.3-5+deb13u21:2026.7.7-2
tuxera NTFS-3G<2026.7.7
Remediation
Event History
Jul 17, 2026
CVE Published
via Ubuntu·02:47 PM
Data Sourced
via Ubuntu·02:47 PM
RemedyDescriptionSeverityAffected Software
Jul 20, 2026
Data Sourced
via Debian·02:50 PM
DescriptionAffected Software
Oct 7, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 10, 2026
Data Sourced
via Microsoft·08:06 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-42617?
The severity of CVE-2026-42617 is rated as 5.
2
What is CVE-2026-42617 related to?
CVE-2026-42617 is related to vulnerabilities in the ntfs-3g software package on Debian.
3
How do I fix CVE-2026-42617?
To fix CVE-2026-42617, it is recommended to update the ntfs-3g package to the latest version provided by the Debian maintainers.
4
When was CVE-2026-42617 last updated?
CVE-2026-42617 was last updated on 16 July 2026.
5
What systems are affected by CVE-2026-42617?
CVE-2026-42617 specifically affects systems running the ntfs-3g software package on Debian.