CVE-2026-42616 is a heap buffer overflow in the cat() function of ntfscat in NTFS-3G, triggered by reading a file from a crafted NTFS image. The record scores it 7.8 (High). Affected are versions 2026.2.25 and earlier, and the fixed release is 2026.7.7.
What's affected
The GitHub advisory GHSA-p6mp-gp2j-7358 lists NTFS-3G 2026.2.25 and earlier as affected, with the patch in 2026.7.7. Patch files are also provided for 2022.10.3 and 2026.2.25 for those who cannot move to the new release. The advisory says there are no known workarounds, other than not using ntfscat as superuser.
Source conflict to note: the record scores this 7.8 (High) with CVSS 3.1 and the weakness CWE-787. The advisory scores it 7.1 (High) with CVSS 4.0, and names CWE-122 and CWE-131. Both are High.
Weakness classes: CWE-787 in the record, plus CWE-122 and CWE-131 in the advisory.
How to check if you're exposed
Run ntfs-3g -V to read the installed version, and compare it with 2026.7.7. Linux distributions often backport fixes without changing the upstream version number, so also check your distribution's security tracker for CVE-2026-42616 and the package changelog.
Then ask whether ntfscat is ever used. It is a utility that prints files from an NTFS volume, and it is used in forensics, recovery and dual boot rescue work. If nobody runs it, the exposure is low, though the package may still be installed.
What to do now
- Upgrade NTFS-3G to 2026.7.7 or later, or install your distribution's patched package.
- If you cannot upgrade, apply the project's patch for 2022.10.3 or 2026.2.25 where it fits.
- Do not run ntfscat as superuser on images or disks from untrusted sources. This is the advisory's guidance.
- Handle untrusted disk images in a disposable virtual machine, not on your workstation.
- Check forensic and recovery toolkits and live images for bundled NTFS-3G copies.
Why it matters
The flaw is a heap buffer overflow, and the advisory attributes it to a size miscalculation. A crafted NTFS image causes the tool to write beyond its heap allocation as it reads a file. The record says user interaction is needed, since someone has to run the tool on a hostile image, and the attack is local.
The lesson for defenders is that file system parsers sit on the boundary with untrusted media: USB drives, disk images and evidence files. The KEV flag is false and the advisory reports no exploitation.
Try it yourself
A flaw in ntfscat only matters if ntfscat is used. This demo shows how reachability analysis separates installed code from code that is actually exercised.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect mounting NTFS drives?
The advisory describes the bug in the cat() function of the ntfscat binary. It does not describe the mount driver as affected.
Is there a workaround?
The advisory says none, other than not using ntfscat as superuser.
Sources
Last reviewed: 18 October 2026.
