A heap buffer overflow in the ntfs_decompress() function of NTFS-3G allows a malicious NTFS image to corrupt a single byte of heap memory. The corrupted data can alter control flow or data structures used by the program. Because the ntfs-3g binary commonly runs with the SUID‑root bit set, an attacker who can trigger the overflow could potentially gain elevated privileges or execute arbitrary code with root rights.

All installations of NTFS-3G prior to version 2026.7.7 that are built with the SUID‑root bit enabled. The vulnerability is present in the ntfs_decompress() implementation in the compress.c source file for these builds.

The CVSS score of 7.1 indicates high severity. The exploit is a local attack that requires an attacker to present a specially crafted NTFS image to the vulnerable binary. No publicly disclosed remote exploitation vectors are known, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because impact is potentially critical if the attacker can achieve a successful heap overflow, but the lack of a known remote trigger keeps the immediate exploitation risk moderate without further analysis.