Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-39258: NTFS-3G File System Can Leak Sensitive Data from NTFS Images

CVE-2021-39258 · published 5 years ago

Summary

If a malicious NTFS image is accessed, the NTFS-3G file system may reveal sensitive information from the image. This can happen when using NTFS-3G versions earlier than 2021.8.22. Update to a newer version of NTFS-3G to address this issue.

Original advisory text

A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.

References

https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html Vendor Advisory
https://security.gentoo.org/glsa/202301-01 Vendor Advisory
https://www.debian.org/security/2021/dsa-4971 Vendor Advisory
https://github.com/tuxera/ntfs-3g/releases Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Timeline

Published7 Sep 2021

Updated13 Mar 2026

First seen13 Mar 2026

Sources

CVE-2021-39258 · OSV

Track software like this

Free during beta