A heap buffer overflow in the ntfs_ir_to_ib() function of NTFS-3G before version 2026.7.7 allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary. By crafting a malicious NTFS image that causes a directory to be extended—such as by creating a new file—the overflow can be triggered, and based on the description, this could lead to arbitrary code execution and privileged escalation to root.

Any installation of NTFS-3G that uses the SUID-root binary and has a version older than 2026.7.7 is vulnerable. Based on the description, it is inferred that typical Linux distributions mount NTFS volumes with ntfs-3g, as the binary often runs with elevated privileges.

Based on the description, the vulnerability is not listed in the CISA KEV catalog and the EPSS score is not available. The CVSS score of 7.1 indicates a high severity and confirms that a local attacker who can create a malicious NTFS image can corrupt heap memory in the SUID-root ntfs-3g binary, potentially leading to root privilege escalation. The nature of a heap buffer overflow in a privileged binary signifies a high likelihood of successful exploitation.