A heap buffer overflow in the function ntfs_index_walk_down() in libntfs-3g/index.c allows an attacker to corrupt memory used by the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The vulnerability is triggered while reading specially crafted file metadata and can lead to privilege escalation to root on systems where the binary is installed with SUID permissions. The flaw originates from index traversal during NTFS volume mounting.

The affected product is the ntfs-3g file system driver, in all releases prior to version 2026.7.7. The SUID-root binary ntfs-3g is used to mount NTFS volumes in user space, and systems that rely on this driver with the SUID bit enabled are exposed.

Because the binary runs with elevated privileges, exploitation could grant the attacker full root control. The exploit requires the ability to present a crafted NTFS image to the driver, which can be achieved through local file creation or mounting a remote NTFS volume prepared by the attacker. The CVSS score of 8.1 indicates a high severity, and combined with the potential for privilege escalation, the risk remains high. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but administrators should still treat it as a significant threat and apply the 2026.7.7 update promptly.