CVE-2026-46062

ntfs3: fix integer overflow in run_unpack() volume boundary check

High · published May 27, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
8.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix integer overflow in run_unpack() volume boundary check

The volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw

addition which can wrap around for large lcn and len values, bypassing

the validation. Use check_add_overflow() as is already done for the

adjacent prev_lcn + dlcn and vcn64 + len checks added by commit

3ac37e100385 ("ntfs3: Fix integer overflow in run_unpack()").

Found by fuzzing with a source-patched harness (LibAFL + QEMU).

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.8th percentile
Published
2026-05-27T12:57Z
EPSS history
Timeline
  • 27 MAY 12:57Z
    ntfs3: fix integer overflow in run_unpack() volume boundary check
    cvelistv5