CVE-2026-42618: Buffer Overflow
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsdecompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ntfs-3gto a version that resolves this vulnerability.Fixed in 1:2022.10.3-5+deb13u2Fixed in 1:2026.7.7-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2022.10.3-5 - Upgrade
Upgrade
NTFS-3Gto a version that resolves this vulnerability.Fixed in 2026.7.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42618?
CVE-2026-42618 has a risk rating of 5, indicating a medium level of severity.
What software is affected by CVE-2026-42618?
CVE-2026-42618 affects the Debian version of the ntfs-3g software.
How do I fix CVE-2026-42618?
To fix CVE-2026-42618, ensure that you update to the latest version of the ntfs-3g software provided by Debian.
What type of vulnerability is CVE-2026-42618?
CVE-2026-42618 is categorized as a security vulnerability affecting filesystem operations.
When was CVE-2026-42618 last updated?
CVE-2026-42618 was last updated on 16 July 2026.