CVE-2026-46571
published 2026-10-07CVE-2026-46571: In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.13%
2.5th percentile
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tuxera | ntfs-3g | < 2026.7.7 | 2026.7.7 |
| ubuntu | ntfs-3g | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image
bugzilla·2026-10-07·CVSS 5.5
CVE-2026-46571 [MEDIUM] CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image
CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.
Bugzilla
CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image [epel-all]
bugzilla·2026-10-07·CVSS 5.5
CVE-2026-46571 [MEDIUM] CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image [epel-all]
CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.
Bugzilla
CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image [fedora-all]
bugzilla·2026-10-07·CVSS 5.5
CVE-2026-46571 [MEDIUM] CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image [fedora-all]
CVE-2026-46571 ntfs-3g: ntfs-3g: Information disclosure via crafted NTFS filesystem image [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.
2026-10-07
Published