NTFS-3G 2026.9.18 Fixes Eight Security Flaws

NTFS-3G 2026.9.18 was released on September 23 as a security update for the widely used open-source NTFS read/write stack. The release notes list eight security fixes spanning heap out-of-bounds access, heap corruption, multiple heap buffer overflows and a denial-of-service condition.

NTFS-3G is used to access NTFS volumes from Linux and several other Unix-like systems, so malformed filesystem metadata is the important trust boundary here. The project credits Jurre van Bergen and France’s cybersecurity agency ANSSI for security reports contributing to this release.

Filesystem parsers consume complex, attacker-influenced metadata before a user ever opens an ordinary document. That makes memory-safety flaws in filesystem code materially different from a bug in a file viewers’ presentation layer: simply processing a deliberately malformed volume can be enough to reach vulnerable parsing paths, depending on the specific advisory and system configuration.

That does not mean plugging in any NTFS drive gives an attacker automatic code execution. The eight release-note entries have different failure modes, and the project describes one specifically as denial of service. Exploitability and privilege impact have to be assessed per advisory rather than inferred from the phrase “heap buffer overflow.”

Outside the eight security advisories, 2026.9.18 fixes stale $MFTMirr data in ntfsresize when the first extent of the NTFS master file table is relocated. It also guards against multiple creator-owner and creator-group access-control entries during ACL inheritance and fixes missing cleanup in ntfscat after an error.

The $MFTMirr fix is operationally important even though the project does not list it as one of the eight security advisories. Filesystem-resizing tools modify structural metadata, so correctness fixes in that path are a reason to avoid treating this release as security-only housekeeping.

NTFS-3G 2026.7.7, released in July, already fixed a separate set of memory-corruption and out-of-bounds issues involving malicious or corrupt NTFS data. The September release is therefore not a reissue of those July fixes; it addresses another group of reported flaws.

For systems that routinely mount removable NTFS media or exchange drives with Windows PCs, keeping the filesystem stack current is the practical takeaway. The project itself recommends using an up-to-date distribution package for ordinary installations.