CVE-2026-46569: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-46569 is a heap buffer overflow vulnerability in NTFS-3G's ntfs_ib_copy_tail() function (located in libntfs-3g/index.c) that allows a local attacker to corrupt heap memory in the SUID-root ntfs-3g binary by mounting a crafted malicious NTFS image. All versions of NTFS-3G prior to 2026.7.7 (including 2026.2.25 and earlier) are affected. The vulnerability was disclosed on July 15, 2026, when the patched release 2026.7.7 was published. It carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a missing range check in ntfs_ib_copy_tail() within libntfs-3g/index.c, classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The overflow is triggered when a directory is extended — for example, by creating a file — while processing a maliciously crafted NTFS filesystem image, causing tail data from an index block to be copied into a freshly allocated block beyond its bounds. Because ntfs-3g is typically installed as a SUID-root binary, the heap corruption occurs in a privileged context. The vulnerability was discovered by Alexandro Calo' from Nozomi Networks Labs (referenced as NN-2026-0088) and Jurre van Bergen (GitHub Advisory, NTFS-3G Releases).

Successful exploitation can lead to heap memory corruption in the SUID-root ntfs-3g binary, potentially enabling a local attacker to achieve arbitrary code execution with root privileges. This results in a complete integrity and availability compromise of the affected system, with the potential for full privilege escalation from an unprivileged local user to root. Confidentiality impact is rated None in the CVSS v3.1 scoring, though root-level code execution in practice could expose all data on the system (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.169%, reflecting a low probability of near-term exploitation. Exploitation requires local access and the ability to supply a crafted NTFS image, and the NVD SSVC assessment classifies it as non-automatable (GitHub Advisory).

1. Prepare a malicious NTFS image: Craft a specially constructed NTFS filesystem image containing a malformed index block structure designed to trigger an out-of-bounds write in ntfs_ib_copy_tail() when a directory is extended.
2. Deliver the image to the target: Place the malicious NTFS image on removable media (e.g., USB drive) or make it accessible via a network share, exploiting scenarios where users or automated systems mount external NTFS volumes.
3. Trigger mounting via ntfs-3g: Cause the SUID-root ntfs-3g binary to mount the malicious image, either by convincing a user to mount it or by exploiting auto-mount functionality on the target system.
4. Trigger directory extension: Perform a file creation operation within the mounted filesystem to trigger the directory extension code path, causing ntfs_ib_copy_tail() to copy index tail data beyond the allocated heap buffer.
5. Achieve heap corruption and privilege escalation: The out-of-bounds write corrupts adjacent heap memory in the SUID-root process; with a carefully crafted payload, this can be leveraged to redirect execution flow and achieve arbitrary code execution as root (GitHub Advisory, NTFS-3G Releases).

• Process: Unexpected child processes spawned by ntfs-3g (e.g., /bin/bash, sh, python) with elevated (root) privileges from a non-root parent process.
• File System: Unusual files or scripts created in system directories (e.g., /etc/cron.d/, /tmp/, /root/) shortly after an NTFS volume was mounted; unexpected SUID binaries appearing on the filesystem.
• Logs: System logs (/var/log/syslog, /var/log/auth.log) showing ntfs-3g invocations with unusual or externally supplied NTFS image paths; kernel or FUSE error messages related to index block processing.
• Network: Outbound connections from the host to unknown external IPs following an NTFS mount event, potentially indicating post-exploitation activity such as reverse shell establishment.

Upgrade NTFS-3G to version 2026.7.7 or later, which includes the fix for CVE-2026-46569 along with patches for several other related vulnerabilities. The GitHub security advisory notes that no known workarounds exist for this vulnerability. As interim risk reduction measures, administrators should restrict user ability to mount NTFS filesystems from untrusted or external media, and consider removing the SUID bit from the ntfs-3g binary (chmod u-s /usr/bin/ntfs-3g) if privileged mounting by non-root users is not required. Patches for older supported versions (2022.10.3 and 2026.2.25) are also available as backport patch files (GitHub Advisory, NTFS-3G Releases).

The vulnerability was credited to Alexandro Calo' from Nozomi Networks Labs (reported as NN-2026-0088) and Jurre van Bergen, indicating coordinated disclosure with the NTFS-3G maintainers. Red Hat tracked the issue as a high-severity privilege escalation bug in their Bugzilla system. The fix was included in the NTFS-3G 2026.7.7 security release alongside seven other CVEs, which received coverage from Linux distribution security channels including Ubuntu (USN-8554-1), SUSE, Debian, and Gentoo (GitHub Advisory, Red Hat Bugzilla).