A heap buffer overflow vulnerability in the Tuxera NTFS-3G driver poses a significant security risk by potentially allowing local attackers to achieve arbitrary code execution via crafted file system images.

This is a heap-based buffer overflow (CWE-122) occurring within the ntfs_build_permissions_posix function of the acls.c source file. The vulnerability is triggered during standard read operations, such as directory listing or opening files, when processing malicious security descriptors, and it affects the SUID-root ntfs-3g binary.

The vulnerability carries a CVSS score of 8.4, reflecting its potential for total system compromise when exploited by a local attacker. Successful exploitation allows for privilege escalation to root, which could lead to complete loss of data confidentiality, integrity, and system availability. Given that the ntfs-3g binary often runs with root privileges, this flaw poses a severe risk to any Linux or Unix-like system mounting untrusted NTFS volumes.

Immediate Action: Update the NTFS-3G package to version 2026.2.25 or later as provided by your distribution vendor.

Proactive Monitoring: Audit system logs for unexpected crashes of the ntfs-3g binary or unusual mount-time errors that could indicate attempts to process malicious file system images.

Compensating Controls: Restrict the ability of unprivileged users to mount removable media or external NTFS images using the ntfs-3g driver until the patches are applied.

Public Exploit Available: No (exploit_available: unknown)

Due to the high severity and potential for root-level privilege escalation, administrators must prioritize the update of the NTFS-3G driver across all affected infrastructure. Apply the patch immediately to prevent local attackers from exploiting this memory corruption flaw to gain unauthorized control over the host operating system.