CVE-2026-46570: Buffer Overflow
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsindexwalkdown() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2022.10.3-5 - Upgrade
Upgrade
debian/ntfs-3gto a version that resolves this vulnerability.Fixed in 1:2022.10.3-1+deb12u4Fixed in 1:2022.10.3-5+deb13u2Fixed in 1:2022.10.3-5+deb13u3Fixed in 1:2026.9.28-2 - Upgrade
Upgrade
debian/ntfs-3gto a version that resolves this vulnerability.Fixed in 1:2022.10.3-1+deb12u4 - Upgrade
Upgrade
debian/ntfs-3gto a version that resolves this vulnerability.Fixed in 1:2022.10.3-5+deb13u2 - Upgrade
Upgrade
debian/ntfs-3gto a version that resolves this vulnerability.Fixed in 1:2026.7.7-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46570?
CVE-2026-46570 has been rated with a risk level of 26.
What software is affected by CVE-2026-46570?
CVE-2026-46570 affects the ntfs-3g software on Debian systems.
How can I mitigate CVE-2026-46570?
Mitigation for CVE-2026-46570 involves updating to the latest version of the ntfs-3g package that includes the necessary security fixes.
When was CVE-2026-46570 last updated?
CVE-2026-46570 was last updated on 16 July 2026.
What type of vulnerability is CVE-2026-46570?
CVE-2026-46570 is identified as a vulnerability affecting filesystem integrity in the ntfs-3g software.