CVE-2026-46569 is a high severity (CVSS 7.7) heap buffer overflow in NTFS-3G, the userspace NTFS driver. A crafted NTFS image can corrupt heap memory in the SUID-root ntfs-3g binary. Upgrade to release 2026.7.7 or install a distribution package that carries the backported fix.
What's affected
- NTFS-3G: the record says versions before 2026.7.7. Fixed in 2026.7.7.
- The GitHub advisory lists 2026.2.25 and earlier as affected and links backport patches for 2022.10.3 and 2026.2.25, for distributions that stay on older bases.
Severity sources differ. The record scores it 7.7 (High). The advisory scores it 7.5 (CVSS 4.0, High) with a local attack vector and high attack complexity. The advisory states there are no known workarounds.
How to check if you're exposed
Print the installed version and package:
ntfs-3g --version
dpkg -l ntfs-3g
rpm -q ntfs-3g
Use the command that matches your distribution. Because distributions backport fixes without changing the upstream number, a package version that looks old may or may not be patched. Check the vendor security tracker or package changelog for this CVE id.
Also check whether the binary is installed set-uid root, which the record describes as the source of the added risk:
ls -l $(command -v ntfs-3g)
What to do now
- Upgrade to NTFS-3G 2026.7.7 or a distribution package that lists this CVE as fixed.
- If you maintain an older base, review the backport patches the advisory links.
- Avoid mounting NTFS images or drives from sources you do not trust until you are patched. This is general hygiene, not an advisory workaround.
- Rebuild or refresh base images and recovery media that bundle ntfs-3g.
Why it matters
The record lists CWE-122, heap based buffer overflow, and CWE-787, out of bounds write. The overflow is in ntfs_ib_copy_tail() in libntfs-3g/index.c. It is triggered when a directory is extended, for example by creating a file on a volume with a crafted image.
Memory corruption in a set-uid root program matters because a flaw in the program can turn into code running with higher privileges than the user who started it. The advisory rates attack complexity as high and the vector as local, so this is mostly relevant where untrusted media can be mounted. The record does not mark this CVE as known exploited.
Quick check
Is there a workaround?
The advisory says no known workarounds. Upgrade or install a vendor backport, and avoid mounting untrusted images in the meantime.
Why does SUID-root matter here?
A bug in a program that runs with root privileges can give an unprivileged local user a path to elevated access, which raises the stakes compared with an ordinary crash.
Sources
Last reviewed: 18 October 2026.
