SB2026110589 - Fedora EPEL 9 update for ntfs-3g
Published: November 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-42616)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory in ntfscat, potentially leading to arbitrary code execution or a denial of service.
The vulnerability exists due to a heap-based buffer overflow in the cat() function in ntfscat.c when reading a file from a malicious NTFS image. A remote attacker can craft an NTFS image and induce a victim to read a file from it using ntfscat to corrupt heap memory, potentially leading to arbitrary code execution or a denial of service.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-42617)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory, potentially leading to arbitrary code execution with root privileges or a denial of service.
The vulnerability exists due to a heap-based buffer overflow in ntfs_ir_to_ib() in index.c when extending a directory on a malicious NTFS image. A remote attacker can craft an NTFS image and trigger directory extension, such as by creating a file, to corrupt heap memory in the SUID-root ntfs-3g binary.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-42618)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary.
The vulnerability exists due to a heap-based buffer overflow in ntfs_decompress() in compress.c when reading a specially crafted compressed file from an NTFS image. A remote attacker can craft a malicious NTFS image to trigger a one-byte heap memory overwrite when the file is read.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-46569)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory in the SUID-root ntfs-3g binary.
The vulnerability exists due to a heap-based buffer overflow caused by a missing range check in ntfs_ib_copy_tail() in libntfs-3g/index.c when extending a directory on a malicious NTFS image. A remote attacker can craft an NTFS image that triggers the overflow during directory extension, such as file creation, to corrupt heap memory in the SUID-root binary.
5) Out-of-bounds read (CVE-ID: CVE-2026-46571)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose potentially confidential information from NTFS-3G process memory.
The vulnerability exists due to an out-of-bounds read in ntfs_fix_file_name() in libntfs-3g/reparse.c when processing a readlink operation on a corrupted file. A local user can craft a malicious NTFS image that triggers the out-of-bounds read during this operation to disclose potentially confidential process memory.
The vulnerable behavior occurs when the ignore_case mount option is used.
6) Heap-based buffer overflow (CVE-ID: CVE-2026-46570)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory, potentially causing a denial of service or arbitrary code execution with root privileges.
The vulnerability exists due to a heap-based buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c when reading specially crafted file metadata. A remote attacker can craft a malicious NTFS image to corrupt heap memory in the SUID-root ntfs-3g binary when its metadata is processed.
7) Heap-based buffer overflow (CVE-ID: CVE-2026-46572)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory in the SUID-root ntfs-3g binary, potentially causing a denial of service or arbitrary code execution with elevated privileges.
The vulnerability exists due to a heap-based buffer overflow in ntfs_ib_cut_tail() in libntfs-3g/index.c when creating a file in a specially crafted directory. A remote attacker can craft a malicious NTFS image containing such a directory to trigger heap memory corruption when a file is created in it.
8) Heap-based buffer overflow (CVE-ID: CVE-2026-56135)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt heap memory in the SUID-root ntfs-3g binary.
The vulnerability exists due to a heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c when creating a file in a crafted NTFS directory. A remote attacker can craft a malicious NTFS image to corrupt heap memory when a file is created in the crafted directory.
9) Out-of-bounds read (CVE-ID: CVE-2026-56136)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose potentially confidential information from an ntfs-3g process.
The vulnerability exists due to an out-of-bounds read in the ntfs_ir_nill() function in libntfs-3g/index.c when creating a file with a crafted name on a malicious NTFS image. A local user can craft a malicious NTFS image and trigger creation of a file with a crafted name to read potentially confidential information from the ntfs-3g process.
Remediation
Install update from vendor's website.