Debian dla-4883 : libntfs-3g89 - security update

high Nessus Plugin ID 376470

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4883 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4883-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley November 05, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : ntfs-3g Version : 1:2022.10.3-1+deb12u4 CVE ID : CVE-2026-42616 CVE-2026-42617 CVE-2026-42618 CVE-2026-46569 CVE-2026-46570 CVE-2026-46571 CVE-2026-46572 CVE-2026-56135 CVE-2026-56136 TEMP-0000000-D7723D TEMP-0000000-B9374C TEMP-0000000-724ECC TEMP-0000000-575F54 TEMP-0000000-52FEFD TEMP-0000000-37DA2F TEMP-0000000-17A9B4 TEMP-0000000-001B0E

ntfs-3g is a read-write NTFS driver for FUSE.

A crafted NTFS filesystem can crash the mount helper or the ntfsprogs tools, or disclose process memory. ntfs-3g is installed setuid root, so a local user who can mount such a filesystem can reach these bugs.

CVE-2026-42616

A heap buffer overflow in cat() in ntfscat lets an attacker corrupt heap memory in the ntfscat binary by crafting an NTFS image. The overflow is triggered by reading a file.

CVE-2026-42617

A heap buffer overflow in ntfs_ir_truncate() lets an attacker corrupt heap memory in the setuid root ntfs-3g binary by crafting an NTFS image. The overflow is triggered by extending a directory, for example by creating a file.

CVE-2026-42618

A heap buffer overflow in ntfs_decompress() lets an attacker corrupt one byte of heap memory in the setuid root ntfs-3g binary by crafting an NTFS image. The overflow is triggered by reading that file.

CVE-2026-46569

A heap buffer overflow in ntfs_ib_copy_tail() lets an attacker corrupt heap memory in the setuid root ntfs-3g binary by crafting an NTFS image. The overflow is triggered by extending a directory, for example by creating a file.

CVE-2026-46570

A heap buffer overflow in ntfs_index_walk_down() lets an attacker corrupt heap memory in the setuid root ntfs-3g binary by crafting an NTFS image. The overflow is triggered by reading crafted file metadata.

CVE-2026-46571

An out-of-bounds read in ntfs_fix_file_name() lets an attacker read process memory in ntfs-3g by crafting an NTFS image. The read is triggered by a readlink on a corrupted file.

CVE-2026-46572

A heap buffer overflow in ntfs_ib_cut_tail() lets an attacker corrupt heap memory in the setuid root ntfs-3g binary by crafting an NTFS image. The overflow is triggered by creating a file in a crafted directory.

CVE-2026-56135

A heap buffer overflow in ACL handling, in build_inherited_id(), lets an attacker corrupt heap memory in the setuid root ntfs-3g binary by crafting an NTFS image. The overflow is triggered by creating a file in a crafted directory.

CVE-2026-56136

An out-of-bounds read in ntfs_ir_lookup() lets an attacker read process memory in ntfs-3g by crafting an NTFS image. The read is triggered by creating a file with a crafted name.

NTFS-3G-SA_2026-06-1 is published under these ids. CVE identifiers for that set have been requested and will be published when assigned.

TEMP-0000000-001B0E/GHSA-r6xj-6488-p8mv

A heap out-of-bounds read and write in ntfs_ie_add_vcn() lets an attacker reach past the end of an index entry while a virtual cluster number is appended. A crafted NTFS image triggers this while a directory index is updated.

TEMP-0000000-37DA2F/GHSA-mc3c-983p-wqm8

Heap corruption in ntfs_mapping_pairs_decompress_i() lets a crafted run list wrap the position used while mapping pairs are expanded.
The same upstream change made a failed multi-sector transfer fixup fail the read. Creating a file or a directory then failed (upstream issues #217 and #218), so that hard-fail is reverted, as in ntfs-3g 1:2022.10.3-5+deb13u3 in Trixie. The run-list bounds fix from the same change is kept.

TEMP-0000000-17A9B4/GHSA-wf3w-fjjg-x4w3

A heap buffer overflow in ntfs_external_attr_find() lets an attacker read past an attribute record when the attribute name extends beyond that record. A crafted NTFS image triggers this while an external attribute is looked up.

TEMP-0000000-575F54/GHSA-2c97-47cr-9xr8

A heap buffer overflow in ntfs_ea_check_wsldev() lets an attacker read past an extended attribute when its name or value extends beyond the buffer. A crafted NTFS image triggers this while extended attributes are checked.

TEMP-0000000-D7723D/GHSA-xrvx-6jrp-4q3x

A heap buffer overflow in ntfs_check_restart_area() lets an attacker read past a $LogFile restart area when that area extends into the first multi-sector transfer protected word. A crafted NTFS image triggers this while the log file is checked.

TEMP-0000000-724ECC/GHSA-jcjj-9262-6j6p

A denial of service in ntfs_inode_attach_all_extents() lets a crafted attribute list with a zero-length entry keep the walk from advancing. A crafted NTFS image triggers this while every extent of an attribute is attached.

TEMP-0000000-52FEFD/GHSA-x98j-3g35-f59x

A heap buffer overflow in ntfs_same_sid() lets an attacker read past an access control entry when the owner SID extends beyond the buffer. A crafted NTFS image triggers this while security descriptors are compared.

TEMP-0000000-B9374C/GHSA-pc48-m7cx-qf72

A heap buffer overflow in ntfs_acl_owner() lets an attacker read past an access control entry when the owner ACE is shorter than the SID it names. A crafted NTFS image triggers this while the ACL owner is read.

For Debian 12 bookworm, these problems have been fixed in version 1:2022.10.3-1+deb12u4.

We recommend that you upgrade your ntfs-3g packages.

For the detailed security status of ntfs-3g please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ntfs-3g

Further information about Debian LTS security advisories, how to apply these updates to your system, and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libntfs-3g89 packages.

Plugin Details

Severity: High

ID: 376470

File Name: debian_DLA-4883.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 11/5/2026

Updated: 11/5/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.17

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-42616

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libntfs-3g89, p-cpe:/a:debian:debian_linux:ntfs-3g-dev, p-cpe:/a:debian:debian_linux:ntfs-3g-udeb, p-cpe:/a:debian:debian_linux:ntfs-3g

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 8/10/2026

Reference Information

CVE: CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46571, CVE-2026-46572, CVE-2026-56135, CVE-2026-56136

Detections

Analytics