A heap buffer overflow occurs in the ntfs_build_permissions_posix() function in the acls.c source of NTFS-3G. When the SUID-root executable processes a NTFS image that contains a security descriptor with many ACCESS_DENIED ACEs including WRITE_OWNER from distinct group SIDs, the overflow corrupts heap memory. This flaw maps to CWE-122 and can allow an attacker to execute arbitrary code with root privileges, potentially compromising confidentiality, integrity, and availability of the host system.

The vulnerability affects the Tuxera NTFS-3G implementation, specifically any releases prior to 2026.2.25, including the 2022.10.3 version. The SUID-root binary is the entry point for exploitation.

The CVSS score of 8.4 indicates high severity. Although EPSS data is not available and the vulnerability is not listed in CISA KEV, the exploit is realistic because it is triggered by a crafted NTFS image that can be presented to the system through the SUID-root binary. The likely attack vector involves local or file‑system interaction; an attacker who can mount or request an NTFS volume built from a malicious image can trigger the overflow and gain root access.