CVE-2026-42617

HighCVSS 7.1/10Last modified Oct 8, 2026

Description

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-426187.1In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of CVE-2026-42626.9Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the paramet CVE-2026-426265.9HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).CVE-2026-426276.2In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file CVE-2026-426298.8Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42636.9Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the paramet CVE-2026-426307.5Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.CVE-2026-426317.1Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.CVE-2026-426327.1Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.CVE-2026-426338.5Subscriber SQL Injection in Events Manager <= 7.4.6 versions.CVE-2026-426347.1Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.CVE-2026-426357.1Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.