Unrated

Single-byte heap buffer overflow in ntfs-3g ntfs_decompress()

IdentifiersCVE-2026-42618CWE-122

CVE-2026-42618 is a single-byte heap buffer overflow in the ntfs_decompress() function in ntfs-3g. The flaw is triggered when the software decompresses maliciously crafted compressed file data from an NTFS filesystem or image. Improper bounds handling during decompression can cause a one-byte write past the end of a heap-allocated buffer, resulting in heap memory corruption while parsing attacker-controlled NTFS compressed data.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can corrupt heap memory in the ntfs-3g process while it handles crafted compressed NTFS data. Depending on execution context, this can cause a crash or denial of service, and the available reporting indicates it may also be exploitable for code execution with root privileges or local root privilege escalation when vulnerable ntfs-3g components process attacker-supplied NTFS content.

Mitigation

If you can’t patch tonight, do this now.

Avoid processing untrusted NTFS filesystems, disk images, or compressed NTFS file data with vulnerable ntfs-3g versions until patched. Limit which users and services are permitted to mount or inspect attacker-controlled NTFS media, and avoid running such operations with elevated privileges unless necessary. Where feasible, isolate NTFS parsing and mounting workflows in constrained environments to reduce the impact of exploitation.

Remediation

Patch, then assume compromise.

Upgrade ntfs-3g to version 2026.7.7 or later, which includes the fix for CVE-2026-42618. Where direct upgrade is not immediately possible, apply the vendor-provided patch bundles for the supported older release branches identified for this issue. Distribution users should install the corresponding vendor or OS security update that backports the fix.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

TuxeraNtfs-3gapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

openwallNews

Feb 25, 2026

oss-security - Multiple vulnerabilities in ntfs-3g

Single-byte heap buffer overflow vulnerability in ntfs-3g when decompressing maliciously crafted compressed file data.

opennet ruNews

Dec 25, 2025

�� NTFS-3G 2026.7.7 � �� 9 ��

Vulnerability in the ntfs_decompress() function in NTFS-3G that can enable root code execution when processing a specially crafted compressed file in an NTFS image.

opennetNews

Dec 25, 2025

�� NTFS-3G 2026.7.7 � �� 9 ��

Memory-safety vulnerability in NTFS-3G function ntfs_decompress() that could allow root code execution when processing a specially crafted compressed NTFS file.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1