CVE-2021-39253: 
Alma Linux vulnerability analysis and mitigation

A vulnerability was identified in NTFS-3G versions prior to 2021.8.22, tracked as CVE-2021-39253. The vulnerability involves an out-of-bounds read in the ntfsrunlistsmerge_i function when processing a crafted NTFS image (NTFS3G Advisory, Debian Security).

The vulnerability is characterized by an out-of-bounds read condition that occurs in the ntfsrunlistsmerge_i function when processing specially crafted NTFS images. The issue was discovered in August 2021 and was assigned a moderate severity rating (NTFS3G Advisory).

The vulnerability could potentially allow an attacker using a maliciously crafted NTFS-formatted image file or external storage to execute arbitrary privileged code. This is particularly concerning if the attacker has local access and the ntfs-3g binary is setuid root, or if they have physical access to an external port on a computer configured to run the ntfs-3g binary (NTFS3G Advisory).

The vulnerability was fixed in NTFS-3G version 2021.8.22. Users are strongly recommended to upgrade to this version or later. No alternative workarounds are available (NTFS3G Advisory, Debian Security).