NTFS-3G Update Brings Many Security Fixes

NTFS-3G 2026.9.18 was released this morning as the newest update to this FUSE-based open-source driver for NTFS file-system support.

NTFS-3G continues kicking for Linux and other FUSE-supported platforms as an alternative to the in-kernel NTFS and NTFS3 Linux drivers. Today's NTFS-3G 2026.9.18 is primarily about delivering various security fixes and bug fixes that have come about the past few months.

NTFS-3G was affected by a number of heap buffer overflows, possible heap data corruption, a denial of service vector, and other issues:

- Guard against multiple creator-owner and creator-group ACEs during ACL inheritance.
- (ntfscat) Fix missing cleanup of opened attribute on error .
- Fix heap out of bounds read/write in ntfs_ie_add_vcn(). (GHSA-r6xj-6488-p8mv)
- Fix heap data corruption in ntfs_mapping_pairs_decompress_i(). (GHSA-mc3c-983p-wqm8)
- Fix heap buffer overflow in ntfs_external_attr_find(). (GHSA-wf3w-fjjg-x4w3)
- Fix heap buffer overflow in ntfs_ea_check_wsldev(). (GHSA-2c97-47cr-9xr8)
- Fix heap buffer overflow in (ntfs_check_restart_area()`. (GHSA-xrvx-6jrp-4q3x)
- Fix denial-of-service in ntfs_inode_attach_all_extents(). (GHSA-jcjj-9262-6j6p)
- Fix heap buffer overflow in ntfs_same_sid(). (GHSA-x98j-3g35-f59x)
- Fix heap buffer overflow in ntfs_acl_owner(). (GHSA-pc48-m7cx-qf72)
- (ntfsresize) Fix stale $MFTMirr data when the first extent of $MFT is relocated.

The new NTFS-3G FUSE driver release is available from GitHub for those interested.