CVE-2026-42616
highIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by craftin…
Vendor / product: Tuxera — ntfs-3g
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.
CVSS
7.8
7.8 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-10-07 14:17
Modified: 2026-10-19 19:18
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
tuxera / ntfs-3g <2026.7.7
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-p6mp-gp2j-7358
References
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗