Unrated

Heap memory corruption in ntfs-3g ntfs_index_walk_down()

IdentifiersCVE-2026-46570CWE-787

CVE-2026-46570 is a heap memory corruption vulnerability in ntfs-3g affecting the ntfs_index_walk_down() function. The flaw is triggered when the software processes maliciously crafted or corrupt NTFS index data that causes descent to an out-of-bounds tree depth. Unsafe handling of this malformed index structure can corrupt heap memory during NTFS metadata traversal. Because ntfs-3g is used to parse and mount NTFS filesystems, the issue is reachable through specially crafted NTFS filesystem images or metadata presented to a vulnerable system.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause heap corruption leading to process crashes or other denial-of-service conditions. In the more severe case, the memory corruption may be exploitable for arbitrary code execution in the context of the ntfs-3g process; where ntfs-3g operates with elevated privileges, this can result in local root privilege escalation.

Mitigation

If you can’t patch tonight, do this now.

Avoid processing, mounting, or inspecting untrusted NTFS filesystem images with vulnerable ntfs-3g builds until patched. Restrict which users and services are permitted to invoke ntfs-3g against attacker-controlled removable media or disk images, and prefer isolated or least-privileged handling of untrusted filesystem content. No specific vendor workaround beyond updating is described.

Remediation

Patch, then assume compromise.

Upgrade ntfs-3g to version 2026.7.7 or later, which includes the fix for CVE-2026-46570. Where direct upgrade is not immediately possible, apply the vendor-provided patch bundles for supported older branches such as 2026.2.25 or 2022.10.3 if those branches are in use. Debian stable users should install the fixed ntfs-3g package version 1:2022.10.3-5+deb13u2 or later as provided by the distribution.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

TuxeraNtfs-3gapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

openwallNews

Feb 25, 2026

oss-security - Multiple vulnerabilities in ntfs-3g

Heap memory corruption vulnerability in ntfs-3g caused by maliciously crafted or corrupt index data descending to an out-of-bounds tree depth.

opennet ruNews

Dec 25, 2025

�� NTFS-3G 2026.7.7 � �� 9 ��

Vulnerability in the ntfs_index_walk_down() function in NTFS-3G that may allow root code execution through a specially crafted NTFS image.

opennetNews

Dec 25, 2025

�� NTFS-3G 2026.7.7 � �� 9 ��

Memory-safety vulnerability in NTFS-3G function ntfs_index_walk_down() that could allow root code execution via a specially crafted NTFS image.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1