CVE-2022-40284: Debian Linux

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Tuxera Ntfs-3g: before 2022.10.3 (fixed in 2022.10.3)

Published 2022-11-06. Last modified 2026-06-17.