CVE-2021-39263

HIGH 7.8CVE-2021-39263 · Published 07/09/2021 · updated 17/06/2026

In short

CVE-2021-39263 is a HIGH (CVSS 7.8) vulnerability affecting ntfs-3g (tuxera).
Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 39.3% of all vulnerabilities.
Fix: update to 2021.8.22 or later.

Package	Affected versions	Patched versions
ntfs-3g tuxera	`< 2021.8.22`	`2021.8.22`

Description

A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.

References

tuxera/ntfs-3g release · Release Notes
tuxera/ntfs-3g security advisory · Third Party Advisory
lists.debian.org/debian-lts-announce/2021/11/msg00013.html · Mailing List
security.gentoo.org/glsa/202301-01 · Third Party Advisory
debian.org/security/2021/dsa-4971 · Third Party Advisory

More vulnerabilities in ntfs-3g

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ntfs-3g

tuxera

< 2021.8.22

2021.8.22

More vulnerabilities in ntfs-3g

See all →