Loading story…
Tuxera released NTFS-3G 2026.7.7 to fix nine vulnerabilities in the userspace NTFS driver and related ntfsprogs utilities, after coordinated disclosure by Nozomi Networks. The issues were assigned CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46571, CVE-2026-46572, CVE-2026-56135, and CVE-2026-56136, and include heap memory corruption, heap buffer overflows, single-byte heap overflow, and out-of-bounds read/access conditions. Tuxera also published patch bundles for versions 2026.2.25 and 2022.10.3.
The flaws can be triggered by malformed or maliciously crafted NTFS filesystem structures, compressed file data, or specially prepared NTFS images, potentially causing crashes, denial of service, memory corruption, or in some cases code execution or privilege escalation to root when vulnerable components process attacker-controlled NTFS data. Affected code paths include functions such as ntfs_ib_copy_tail(), ntfs_ir_to_ib(), ntfs_decompress(), ntfs_index_walk_down(), ntfs_ib_cut_tail(), build_inherited_id(), and the ntfscat utility, prompting maintainers to urge users to update to the patched release.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside the main release, Tuxera provided patch bundles for versions 2026.2.25 and 2022.10.3 to address the disclosed vulnerabilities in older supported code lines.
Tuxera disclosed multiple vulnerabilities in ntfs-3g and released version 2026.7.7 to fix nine CVEs, including heap corruption, buffer overflow, and out-of-bounds read issues. The flaws could be triggered by corrupt or maliciously crafted NTFS filesystem structures or compressed file data.
Nozomi Networks reported multiple vulnerabilities in ntfs-3g to Tuxera and coordinated disclosure with the vendor. The issues involved memory corruption, buffer overflows, and out-of-bounds access triggered by malformed NTFS data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
openwall.com
Open sourcegithub.com
Open sourceseclists.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub Security Lab disclosed a set of vulnerabilities in **7-Zip** affecting archive and filesystem-image parsing, with the most serious issue tracked as **`CVE-2026-48095`** (`GHSL-2026-140`). The flaw is a **heap buffer write overflow** in NTFS compressed stream handling, specifically tied to edge-case parsing in `GetCuSize()`, and could potentially lead to arbitrary code execution when a crafted filesystem image is processed. A proof-of-concept described a malformed sparse NTFS disk image that abuses abnormal cluster sizing and compressed `$DATA` attributes to trigger the bug. The broader set of advisories also covered additional defects in parsing formats including **SquashFS, UEFI, UDF, WIM, 7z, and Ar**, as well as a **path traversal** issue in a sample application. According to reporting on the disclosures, **seven of eight** advisories in the set received CVE identifiers, and the issues were addressed in **7-Zip 26.01**. GitHub Security Lab also categorized the advisory pages in its AI-agent index as discoveries associated with AI-assisted research, though no specific agent was publicly identified.
Jul 20, 2026
A critical vulnerability in **7-Zip** tracked as `CVE-2026-48095` and `GHSL-2026-140` allows attackers to trigger a heap-based buffer overflow when a user opens a specially crafted archive containing an **NTFS volume image**. The flaw affects **7-Zip 26.00 and earlier** and stems from incorrect buffer size calculations and insufficient boundary checks in the NTFS handler, where a computed buffer can shrink to **1 byte** while later logic writes up to **256 MB** of attacker-controlled data into it. Researchers said the bug can cause memory corruption, crashes, denial of service, and potentially **arbitrary code execution**, including through possible vtable pointer overwrite under favorable conditions. The vulnerable NTFS handler is enabled by default in stock `7z.dll`, and exploitation does not depend on a specific file extension because 7-Zip uses signature-based fallback matching for NTFS images. The issue was privately reported to the developers in April and fixed in **7-Zip 26.01**, with vendor and researcher advisories later published alongside a Python proof-of-concept. With 7-Zip widely deployed on Windows and Linux systems and embedded in automated workflows and other software, defenders have little mitigation beyond upgrading to the patched release because no workaround has been identified.
Jun 29, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026