CVE-2026-46569: Buffer Overflow
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsibcopytail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ntfs-3gto a version that resolves this vulnerability.Fixed in 1:2022.10.3-5+deb13u2Fixed in 1:2026.7.7-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2022.10.3-5 - Upgrade
Upgrade
ntfs-3gto a version that resolves this vulnerability.Fixed in 2026.7.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46569?
The severity of CVE-2026-46569 is assessed as moderate risk level 26.
How do I fix CVE-2026-46569?
To fix CVE-2026-46569, update the ntfs-3g package to the latest version provided by Debian.
What impact does CVE-2026-46569 have on systems?
CVE-2026-46569 may allow unauthorized access to files, potentially leading to data breaches.
Is CVE-2026-46569 exploitable remotely?
CVE-2026-46569 is not known to be remotely exploitable and typically requires local access.
What software versions are affected by CVE-2026-46569?
CVE-2026-46569 affects specific versions of the ntfs-3g software running on Debian.