CVE-2021-33289

HIGH 7.8CVE-2021-33289 · Published 07/09/2021 · updated 09/07/2026

In short

CVE-2021-33289 is a HIGH (CVSS 7.8) vulnerability affecting ntfs-3g (tuxera).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.0% of all vulnerabilities.
Fix: update to 2021.8.22 or later.

Package	Affected versions	Patched versions
ntfs-3g tuxera	`< 2021.8.22`	`2021.8.22`

Description

In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.

References

openwall.com/lists/oss-security/2021/08/30/1 · Mailing List
tuxera/ntfs-3g security advisory · Third Party Advisory
lists.debian.org/debian-lts-announce/2021/11/msg00013.html · Mailing List
lists.fedoraproject.org/archives/list/[email protected]/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3
lists.fedoraproject.org/archives/list/[email protected]/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI
security.gentoo.org/glsa/202301-01 · Third Party Advisory
debian.org/security/2021/dsa-4971 · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI

More vulnerabilities in ntfs-3g

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free