CVE-2026-46571: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-46571 is an out-of-bounds read vulnerability in NTFS-3G's ntfs_fix_file_name() function within libntfs-3g/reparse.c that allows a local attacker to read potentially confidential information from ntfs-3g process memory by crafting a malicious NTFS image. It affects all NTFS-3G versions through 2026.2.25 and was patched in version 2026.7.7, released July 15, 2026. The vulnerability was reported by Alexandro Calo' from Nozomi Networks Labs and publicly disclosed on October 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the ntfs_fix_file_name() function in libntfs-3g/reparse.c, which processes symlink reparse data. The flaw is triggered when a readlink system call is performed on a corrupted or maliciously crafted file within a mounted NTFS image, causing the function to read memory beyond the intended buffer boundary. Exploitation requires the attacker to supply a crafted NTFS filesystem image and have low-privilege local access to a system running NTFS-3G; no user interaction is required beyond mounting the image. A workaround noted in the advisory is to avoid using the ignore_case mount option until patched (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a confidentiality breach, allowing a low-privileged local attacker to read arbitrary memory from the ntfs-3g process, potentially exposing sensitive data such as cryptographic keys, credentials, or other in-memory secrets. There is no impact to integrity or availability. The scope is limited to the ntfs-3g process itself, with no evidence of lateral movement potential or remote exploitation (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.114%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory, Feedly).

1. Craft a malicious NTFS image: Use a tool such as a hex editor or a custom script to create a corrupted NTFS filesystem image containing a symlink file with malformed reparse data designed to trigger an out-of-bounds read in ntfs_fix_file_name().
2. Mount the image: As a low-privileged local user on a system with NTFS-3G installed, mount the crafted NTFS image using ntfs-3g (e.g., ntfs-3g malicious.img /mnt/target -o allow_other).
3. Trigger the vulnerability: Execute a readlink operation on the corrupted symlink file within the mounted filesystem (e.g., readlink /mnt/target/malicious_symlink), causing ntfs_fix_file_name() to perform an out-of-bounds read.
4. Capture leaked memory: Observe or capture the data returned or leaked from the ntfs-3g process memory, which may contain confidential information such as keys or credentials held in the process's address space (GitHub Advisory).

• File System: Presence of unusual or externally supplied NTFS image files (.img, .ntfs) in user-accessible directories; unexpected mounts of NTFS images by low-privileged users.
• Logs: System logs (/var/log/syslog, dmesg) showing NTFS-3G mount events initiated by non-root users; errors or warnings from ntfs-3g related to reparse data or corrupted filesystem structures.
• Process: ntfs-3g processes spawned by low-privileged users mounting external or unusual NTFS images; readlink calls on files within NTFS-mounted directories shortly after mount events.

Upgrade NTFS-3G to version 2026.7.7 or later, which contains the fix for CVE-2026-46571 along with several other security issues patched in the same release. Backport patches are also available for ntfs-3g 2022.10.3 and 2026.2.25 (ntfs-3g_2022.10.3-cve_2026-04_5.patch and ntfs-3g_2026.2.25-cve_2026-04_5.patch). As a workaround prior to patching, avoid using the ignore_case mount option and restrict mounting of untrusted NTFS images by unprivileged users. Major Linux distributions including Ubuntu (USN-8554-1), SUSE (SUSE-SU-2026:3213-1), and Debian have issued updated packages (GitHub Advisory, NTFS-3G Releases).

The vulnerability was credited to Alexandro Calo' from Nozomi Networks Labs (referenced as Nozomi Labs NN-2026-0089), indicating professional security research involvement. The disclosure was part of a broader security release (NTFS-3G 2026.7.7) that addressed eight CVEs simultaneously, attracting attention from Linux distribution maintainers who rapidly issued updated packages. Coverage appeared in Linux security news outlets and distribution update announcements, and the October 2026 Microsoft Patch Tuesday was noted to reference this CVE as well (GitHub Advisory, NTFS-3G Releases).