Loading story…
Tuxera released NTFS-3G 2026.9.18 to remediate eight vulnerabilities in the FUSE-based NTFS filesystem driver. The flaws include heap buffer overflows, heap data corruption, out-of-bounds reads and writes, and a denial-of-service condition in code handling NTFS attributes, mapping-pair decompression, extended attributes, restart areas, security identifiers, ACL ownership, and inode extent attachment. The highest reported severity is CVSS 6.8 (Moderate), affecting a heap buffer overflow in ntfs_same_sid().
Tuxera also issued patch bundles for the 2022.10.3 and 2026.7.7 branches, while Fedora shipped advisory FEDORA-2026-a2beb6a664 for affected Fedora 46 packages, including ntfs-3g, ntfs-3g-system-compression, partclone, testdisk, and wimlib. The update additionally corrects ACL-inheritance behavior and defects in ntfscat and ntfsresize; CVE identifiers had been requested but were not assigned at disclosure, and no known exploits were reported.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Fedora published advisory FEDORA-2026-a2beb6a664 for Fedora 46, covering ntfs-3g, ntfs-3g-system-compression, partclone, testdisk, and wimlib. The available advisory metadata did not specify a CVE, severity, technical impact, or remediation version.
Alongside the vulnerability disclosure, Tuxera released patch bundles for the ntfs-3g 2022.10.3 and 2026.7.7 release branches.
Tuxera disclosed eight NTFS-3G flaws—including heap buffer overflows, heap data corruption, an out-of-bounds read/write issue, and a denial-of-service condition—and released ntfs-3g 2026.9.18 to fix them. The highest reported severity was CVSS 6.8 for the ntfs_same_sid() heap buffer overflow; CVE IDs had been requested but were still pending.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceseclists.org
Open sourcephoronix.com
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tuxera released **NTFS-3G 2026.7.7** to fix nine vulnerabilities in the userspace NTFS driver and related `ntfsprogs` utilities, after coordinated disclosure by **Nozomi Networks**. The issues were assigned `CVE-2026-42616`, `CVE-2026-42617`, `CVE-2026-42618`, `CVE-2026-46569`, `CVE-2026-46570`, `CVE-2026-46571`, `CVE-2026-46572`, `CVE-2026-56135`, and `CVE-2026-56136`, and include heap memory corruption, heap buffer overflows, single-byte heap overflow, and out-of-bounds read/access conditions. Tuxera also published patch bundles for versions **2026.2.25** and **2022.10.3**. The flaws can be triggered by malformed or maliciously crafted NTFS filesystem structures, compressed file data, or specially prepared NTFS images, potentially causing crashes, denial of service, memory corruption, or in some cases **code execution or privilege escalation to root** when vulnerable components process attacker-controlled NTFS data. Affected code paths include functions such as `ntfs_ib_copy_tail()`, `ntfs_ir_to_ib()`, `ntfs_decompress()`, `ntfs_index_walk_down()`, `ntfs_ib_cut_tail()`, `build_inherited_id()`, and the `ntfscat` utility, prompting maintainers to urge users to update to the patched release.
Jul 16, 2026
GitHub Security Lab disclosed a set of vulnerabilities in **7-Zip** affecting archive and filesystem-image parsing, with the most serious issue tracked as **`CVE-2026-48095`** (`GHSL-2026-140`). The flaw is a **heap buffer write overflow** in NTFS compressed stream handling, specifically tied to edge-case parsing in `GetCuSize()`, and could potentially lead to arbitrary code execution when a crafted filesystem image is processed. A proof-of-concept described a malformed sparse NTFS disk image that abuses abnormal cluster sizing and compressed `$DATA` attributes to trigger the bug. The broader set of advisories also covered additional defects in parsing formats including **SquashFS, UEFI, UDF, WIM, 7z, and Ar**, as well as a **path traversal** issue in a sample application. According to reporting on the disclosures, **seven of eight** advisories in the set received CVE identifiers, and the issues were addressed in **7-Zip 26.01**. GitHub Security Lab also categorized the advisory pages in its AI-agent index as discoveries associated with AI-assisted research, though no specific agent was publicly identified.
Jul 20, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026