CVE-2026-46572: 
Homebrew vulnerability analysis and mitigation

CVE-2026-46572 is a heap buffer overflow vulnerability in NTFS-3G's ntfs_ib_cut_tail() function located in libntfs-3g/index.c. It affects all versions of NTFS-3G prior to 2026.7.7 (including 2026.2.25 and earlier) and allows a local attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The vulnerability was reported by Alexandro Calo' from Nozomi Networks Labs and publicly disclosed on July 15, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a heap-based buffer overflow (CWE-122) combined with an out-of-bounds write (CWE-787) in the ntfs_ib_cut_tail() function within libntfs-3g/index.c, which handles copying the tail data of an index block to a freshly allocated block during a node split operation. An attacker exploits this by crafting a malicious NTFS image with a specially structured directory, then triggering the overflow by creating a file within that directory — causing the SUID-root ntfs-3g process to write beyond the bounds of a heap-allocated buffer. The attack vector is local (AV:L) with high complexity (AC:H), requiring no privileges or user interaction, and the vulnerability is referenced in the Nozomi Networks Labs advisory NN-2026-0091 (GitHub Advisory, NTFS-3G Releases).

Successful exploitation allows an unauthenticated local user to corrupt heap memory in the SUID-root ntfs-3g process, potentially enabling arbitrary code execution with root privileges. This results in full compromise of confidentiality, integrity, and availability on the affected system. Because ntfs-3g runs as root via the SUID bit, privilege escalation from an unprivileged local user to root is the primary risk, as characterized by Red Hat's bug tracker (Red Hat Bugzilla, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.128%, reflecting a low near-term exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. Attribution for discovery goes to Alexandro Calo' of Nozomi Networks Labs (NTFS-3G Releases).

1. Craft a malicious NTFS image: Use a tool such as a custom script or modified mkntfs to create an NTFS filesystem image containing a specially crafted directory with index block structures designed to trigger an out-of-bounds write in ntfs_ib_cut_tail() during a node split.
2. Mount the image via ntfs-3g: As a local (unprivileged) user, invoke the SUID-root ntfs-3g binary to mount the crafted NTFS image (e.g., ntfs-3g malicious.img /mnt/target).
3. Trigger the overflow: Create a file inside the specially crafted directory on the mounted filesystem (e.g., touch /mnt/target/crafted_dir/newfile), causing ntfs_ib_cut_tail() to copy index tail data into a heap buffer with insufficient bounds checking.
4. Achieve heap corruption and code execution: The out-of-bounds write corrupts adjacent heap metadata or function pointers within the SUID-root process, which can be leveraged (with appropriate heap grooming) to redirect execution flow and obtain a root shell (GitHub Advisory, NTFS-3G Releases).

• Process: Unexpected child processes (e.g., /bin/sh, bash) spawned by the ntfs-3g process with root privileges; ntfs-3g processes crashing with segmentation faults or heap corruption errors.
• Logs: System logs (/var/log/syslog, dmesg) showing ntfs-3g crashes, heap corruption messages, or abnormal termination signals (SIGSEGV, SIGABRT) when mounting NTFS images.
• File System: Presence of unusual or externally supplied NTFS image files (.img, .ntfs) in user-accessible directories; unexpected files created in mounted NTFS directories by non-root users.
• Network: Outbound connections from the host shortly after NTFS image mounting activity, potentially indicating post-exploitation reverse shell activity.

The primary remediation is to upgrade NTFS-3G to version 2026.7.7 or later, which contains the fix for this vulnerability. Backport patches are also available for older supported versions: ntfs-3g_2022.10.3-cve_2026-04_7.patch and ntfs-3g_2026.2.25-cve_2026-04_7.patch. No configuration-based workarounds are known; as an interim measure, administrators should restrict which users are permitted to mount NTFS filesystems and avoid mounting untrusted NTFS images. Major Linux distributions including Ubuntu (USN-8554-1), SUSE (SUSE-SU-2026:3213-1), Debian, and Gentoo have issued updated packages (GitHub Advisory, NTFS-3G Releases).

The vulnerability was credited to Alexandro Calo' from Nozomi Networks Labs (referenced as NN-2026-0091), indicating professional security research involvement. The disclosure was coordinated with the NTFS-3G maintainers and resulted in a same-day patch release on July 15, 2026. The fix was picked up rapidly by major Linux distributions including Ubuntu, Debian, SUSE, and Gentoo, reflecting standard industry response to a high-severity SUID binary vulnerability (NTFS-3G Releases, GitHub Advisory).