In the Linux kernel’s ntfs3 filesystem module, the function decompress_lznt indexes a decompression table based on data from the volume header without validating that the index remains within the table boundaries. A maliciously crafted NTFS3 image containing invalid compressed data can overflow this index, causing the driver to read memory beyond the allocated table. This type of flaw is an out-of-bounds read.

The issue exists in the Linux kernel’s ntfs3 driver. All kernel releases that compile the ntfs3 module and have not applied the recent patch are vulnerable. Because the vendor list includes generic Linux and the module is enabled by default in many distributions, any system that mounts NTFS volumes with the ntfs3 filesystem is at risk.

The EPSS score is below 1%, indicating a low probability of exploitation. The flaw is not listed in the CISA KEV catalog, meaning no widespread exploitation has been reported. The CVSS score of 7.8 classifies the vulnerability as high severity, indicating significant impact potential. An attacker can trigger the read simply by presenting a crafted NTFS3 volume; it is inferred that privileged access is not required.