In NTFS-3G before version 2026.7.7, the cat() function in ntfscat.c contains a heap buffer overflow that is triggered when the utility reads a file from a malcrafted NTFS image. The overflow corrupts heap memory which can allow a local attacker to overwrite data structures and potentially execute arbitrary code. The vulnerability is the integrity of the process.

The flaw affects all NTFS‑3G installations that include the ntfscat utility and are built before the 2026.7.7 release. All users running older versions of the NTFS‑3G package are susceptible.

The EPSS score for this vulnerability is < 1% and it is not listed in the CISA KEV catalog, indicating that publicly known exploits are not yet widespread. However, the ability to corrupt heap memory in a user‑space utility implies that a local attacker who can instruct the system to open a malicious NTFS image would be able to elevate privileges or execute code with the privileges of the account running ntfscat. The attack vector is inferred to be local through the manipulation of an NTFS image, as the vulnerability is triggered by reading a file rather than a remote network input.