A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.

Published 4 y ago 2022-05-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 39%

Public exploits

none known

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.

CISA SSVC assessment

0.45% probability of exploitation in the next 30 days, higher than 39% of all scored CVEs.

Assigned by	Version	Score	Vector
CISA ADP	3.1	6.7	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	6.7	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	4.6	`AV:L/AC:L/Au:N/C:P/I:P/A:P`

Weakness

github.com /tuxera/ntfs-3g/releases · x_transferred
github.com /tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x · x_transferred
debian.org /security/2022/dsa-5160 · vendor-advisory, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZ · vendor-advisory, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24W · vendor-advisory, x_transferred
lists.debian.org /debian-lts-announce/2022/06/msg00017.html · mailing-list, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77E · vendor-advisory, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWM · vendor-advisory, x_transferred
security.gentoo.org /glsa/202301-01 · vendor-advisory, x_transferred

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.