https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:31:12 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46072 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntfs3: add buffer boundary checks to run_unpack()</p> <p>run_unpack() checks `run_buf &lt; run_last` at the top of the while loop but then reads size_size and offset_size bytes via run_unpack_s64() without verifying they fit within the remaining buffer. A crafted NTFS image with truncated run data in an MFT attribute triggers an OOB heap read of up to 15 bytes when the filesystem is mounted.</p> <p>Add boundary checks before each run_unpack_s64() call to ensure the declared field size does not exceed the remaining buffer.</p> <p>Found by fuzzing with a source-patched harness (LibAFL + QEMU).</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntfs3: add buffer boundary checks to run_unpack()</p> <p>run_unpack() checks `run_buf &lt; run_last` at the top of the while loop but then reads size_size and offset_size bytes via run_unpack_s64() without verifying they fit within the remaining buffer. A crafted NTFS image with truncated run data in an MFT attribute triggers an OOB heap read of up to 15 bytes when the filesystem is mounted.</p> <p>Add boundary checks before each run_unpack_s64() call to ensure the declared field size does not exceed the remaining buffer.</p> <p>Found by fuzzing with a source-patched harness (LibAFL + QEMU).</p> https://vulnerability.circl.lu/vuln/cve-2026-46072