CVE-2026-42618
published 2026-10-07CVE-2026-42618: In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the…
PriorityP432high7.1CVSS 3.1
AVLACLPRLUINSUCNIHAH
EPSS
0.15%
3.6th percentile
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tuxera | ntfs-3g | < 2026.7.7 | 2026.7.7 |
| ubuntu | ntfs-3g | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress()
bugzilla·2026-10-07·CVSS 7.1
CVE-2026-42618 [HIGH] CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress()
CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress()
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
Bugzilla
CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress() [fedora-all]
bugzilla·2026-10-07·CVSS 7.1
CVE-2026-42618 [HIGH] CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress() [fedora-all]
CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
Bugzilla
CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress() [epel-all]
bugzilla·2026-10-07·CVSS 7.1
CVE-2026-42618 [HIGH] CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress() [epel-all]
CVE-2026-42618 ntfs-3g: ntfs-3g: Privilege escalation via heap-based buffer overflow in ntfs_decompress() [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
2026-10-07
Published