CVE-2021-33287

HIGH 7.8CVE-2021-33287 · Published 07/09/2021 · updated 09/07/2026

In short

CVE-2021-33287 is a HIGH (CVSS 7.8) vulnerability affecting ntfs-3g (tuxera).
Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.7% of all vulnerabilities.
Fix: update to 2021.8.22 or later.

Package	Affected versions	Patched versions
ntfs-3g tuxera	`< 2021.8.22`	`2021.8.22`

Description

In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.

References

openwall.com/lists/oss-security/2021/08/30/1 · Mailing List
tuxera/ntfs-3g security advisory · Third Party Advisory
lists.debian.org/debian-lts-announce/2021/11/msg00013.html · Mailing List
lists.fedoraproject.org/archives/list/[email protected]/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3
lists.fedoraproject.org/archives/list/[email protected]/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI
security.gentoo.org/glsa/202301-01 · Third Party Advisory
debian.org/security/2021/dsa-4971 · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI

More vulnerabilities in ntfs-3g

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free