NTFS-3G contains a heap buffer overflow located in the ntfs_ib_copy_tail() function of libntfs-3g/index.c. The flaw is triggered when the driver processes a malicious NTFS image that extends a directory, such as by creating a file. The overflow corrupts heap memory used by the SUID‑root ntfs‑3g binary; based on this, it is inferred that an attacker could potentially execute arbitrary code with root privileges or otherwise gain elevated authority. The weakness is identified as CWE‑122 and CWE‑787; the advisory does not provide a confirmed execution path, but the impact could include privilege escalation if the exploit succeeds.

The vulnerability affects installations of the NTFS‑3G filesystem driver from tuxera, specifically versions older than 2026.7.7, where the SUID‑root ntfs‑3g binary is deployed. Systems compiling the driver with the default SUID root bit and handling NTFS volumes are therefore exposed.

The CVSS score of 7.7 in the advisory signals a high potential severity. Exploitation would likely require local access to a crafted NTFS image and the ability to mount it, after which the overflow corrupts heap memory of a binary running with root privileges; it is inferred that this could lead to privilege escalation. The EPSS score of < 1% indicates a very low probability of observed exploitation. The vulnerability is not in the CISA KEV catalog, meaning no large‑scale attacks have been documented yet. Based on the description, the root escalation risk warrants timely remedial action.