CVE-2026-42616

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.

• SECURITY UPDATE: heap buffer overflows and out-of-bounds read in index handling
  • debian/patches/CVE-2026-42617_CVE-2026-46572_CVE-2026-56136.patch: validate the index entry stream and INDEX_ROOT.index_block_size read from disk, and check the size copied from the index root to the new index block in ntfs_ir_to_ib(), in include/ntfs-3g/index.h, libntfs-3g/attrib.c and libntfs-3g/index.c.
  • CVE-2026-42617
  • CVE-2026-46572
  • CVE-2026-56136
• SECURITY UPDATE: heap buffer overflow in index block split
  • debian/patches/CVE-2026-46569.patch: bound tail_size against the destination block capacity in ntfs_ib_copy_tail() in libntfs-3g/index.c.
  • CVE-2026-46569
• SECURITY UPDATE: out-of-bounds write when walking a deep index
  • debian/patches/CVE-2026-46570.patch: limit the B-tree depth to MAX_PARENT_VCN in ntfs_index_walk_down() in libntfs-3g/index.c.
  • CVE-2026-46570
• Fix double free when an index entry is too long to hold a VCN
  • debian/patches/index-reject-entry-too-long-for-vcn.patch: reject an index entry that is too long to hold a VCN in ntfs_ie_add_vcn() in libntfs-3g/index.c, as its 16-bit length would wrap to zero.
• SECURITY UPDATE: heap buffer overflow in LZNT1 decompression
  • debian/patches/CVE-2026-42618.patch: end a sub-block when its output is full and check the input bounds before reading sub-block headers and phrase tokens in ntfs_decompress() in libntfs-3g/compress.c, and zero the unused part of the output when the compressed data is garbled.
  • CVE-2026-42618
• SECURITY UPDATE: heap buffer overflow in ntfscat
  • debian/patches/CVE-2026-42616.patch: size the read buffer from the block size in cat() in ntfsprogs/ntfscat.c.
  • CVE-2026-42616

Heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616) Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617) Single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618) Heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569) Heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570) Out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571) Heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572) Heap buffer overflow when building inherited ACL data. (CVE-2026-56135) Out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)

These are all security issues fixed in the libntfs-3g-devel-2022.10.3-8.1 package on the GA media of openSUSE Tumbleweed.

This update for ntfs-3g_ntfsprogs fixes the following issues:

• CVE-2026-42616: heap buffer overflow in cat() of cat.c can lead to heap corruption in the ntfscat binary via a specially crafted NTFS image (bsc#1271102).
• CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() of index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271103).
• CVE-2026-42618: heap buffer overflow in ntfs_decompress() of compress.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271104).
• CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() of libntfs-3g/index.ccan lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271105).
• CVE-2026-46570: heap buffer overflow in ntfs_index_walk_down() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271106).
• CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() of libntfs-3g/reparse.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271107).
• CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271108).
• CVE-2026-56135: heap-based buffer overflow in build_inherited_id() of libntfs-3g/security.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271109).
• CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() of libntfs-3g/index.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271110).

This update for ntfs-3g_ntfsprogs fixes the following issues

• CVE-2026-42616: heap buffer overflow in cat() in cat.c (bsc#1271102).
• CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() in index.c (bsc#1271103).
• CVE-2026-42618: heap buffer overflow in ntfs_decompress() in compress.c (bsc#1271104).
• CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() in libntfs-3g/index.c (bsc#1271105).
• CVE-2026-46570: heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c (bsc#1271106).
• CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() in libntfs-3g/reparse.c (bsc#1271107).
• CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() in libntfs-3g/index.c (bsc#1271108).
• CVE-2026-56135: heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c (bsc#1271109).
• CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() in libntfs-3g/index.c (bsc#1271110).

This update for ntfs-3g_ntfsprogs fixes the following issues

• CVE-2026-42616: heap buffer overflow in cat() of cat.c can lead to heap corruption in the ntfscat binary via a specially crafted NTFS image (bsc#1271102).
• CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() of index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271103).
• CVE-2026-42618: heap buffer overflow in ntfs_decompress() of compress.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271104).
• CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() of libntfs-3g/index.ccan lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271105).
• CVE-2026-46570: heap buffer overflow in ntfs_index_walk_down() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271106).
• CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() of libntfs-3g/reparse.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271107).
• CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271108).
• CVE-2026-56135: heap-based buffer overflow in build_inherited_id() of libntfs-3g/security.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271109).
• CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() of libntfs-3g/index.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271110).

It was discovered that NTFS-3G had a heap buffer overflow when reading certain NTFS images. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2026-42616)

It was discovered that NTFS-3G had multiple heap buffer overflows when processing certain NTFS images. A local attacker could possibly use these issues to execute arbitrary code. (CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46572, CVE-2026-56135)

It was discovered that NTFS-3G had out-of-bounds reads when processing certain NTFS images. A local attacker could possibly use these issues to obtain sensitive information. (CVE-2026-46571, CVE-2026-56136)