NTFS-3G 2026.7.7

Security Release 2026.7.7 (July 15, 2026)
Download: https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2026.7.7.tgz

Checksums:
SHA-256: d67b769025d32860549d35c2147e45024d172f81c540d750390ce3602c059dab
SHA-512: 5b0a866c3c556f97b1c712fd09b148ecfd194429620e1b45f0630f6b4dee6a087496ff9bbe36bfa1a3e7c58483c43d45bb1e03956e0386aebe8b66522d90cdc2

Changes:

• (ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
• Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
• Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
• Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
• Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
• Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
• Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
• Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
• Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)

We'd like to thank to Alexandro Calo' from Nozomi Networks Labs, Abhishek Kumar and Jurre van Bergen for contributing to this release with security reports.

If you have a security issue to report for ntfs-3g, then please follow the process outlined here:
https://www.tuxera.com/security-advisories/

NTFS-3G 2026.2.25

Stable Version 2026.2.25 (April 21, 2026)
Download: https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2026.2.25.tgz

Checksums:
SHA-256: 7754f3b32e8baf9c472459b4e9c981e3ae0f5039107cdd8d8201aed0a949008a
SHA-512: c4f537ea45a6ebb21ddf21fbf4d71ab336fdf9cb1d55a062a6376f90480cf6992b11ad93b4b2bbd8a96e26f97d7c15948d4f6cc71d713e9deb78e3a6cad7438c

Changes:

• Fix bashism in configure script causing errors in non-bash shells.
• (mkntfs) Enable microsecond-level volume creation time.
• Fix two instances of an invalid errno state when encountering NULL in strings.
• Fix a crash when a reparse tag could not be found in the index.
• Fix incorrect MFT free records value when bitmap is expanded.
• Fix 'extras' manpages being installed when extras are disabled.
• Fix various instances of use-after-free conditions in the library and tools.
• Fix typo in NTFS hibernation message. Thanks to Anil Kumar for the report/fix.
• Escape commas in the fsname when libfuse 2.8 or higher is used.
• (ntfsclone) Allow adjusting the sector size in the NTFS boot sector for the target device when restoring images.
• Remove libdl dependency when building without external plugins.
• (ntfsinfo) Show information about the logfile state when dumping metadata.
• (ntfsinfo) Fix displaying crowded directories or indexes.
• (ntfsinfo) Fix displaying the security descriptor list in ntfsinfo.
• Fix heap buffer overflow when POSIX ACLs were enabled (CVE-2026-40706). Thanks to Andrea Bocchetti for the report.
• (ntfsusermap) Fix overflow when constructing backup filename.
• Fix two time-of-check-time-of-use conditions.
• Fix missing malloc/sscanf return value checks.

NTFS-3G 2022.10.3

Security release 2022.10.3 (Oct 3, 2022)
Download: https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2022.10.3.tgz

Changes:

• Rejected zero-sized runs
• Avoided merging runlists with no runs

NTFS-3G 2022.5.17

Security release 2022.5.17 (May 26, 2022)
Download: https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2022.5.17.tgz

Changelog:

• Improved defence against maliciously tampered NTFS partitions
• Improved defence against improper use of options
• Updated the documentation

NTFS-3G 2021.8.22

Stable Version 2021.8.22 (August 30, 2021)
Download: https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2021.8.22.tgz

Changelog:

• Fixed compile error when building with libfuse < 2.8.0
• Fixed obsolete macros in configure.ac
• Signalled support of UTIME_OMIT to external libfuse2
• Fixed an improper macro usage in ntfscp.c
• Updated the repository change in the README
• Fixed vulnerability threats caused by maliciously tampered NTFS partitions

NTFS-3G 2017.3.23AR.6

Stable Version 2017.3.23AR.6 (February 1, 2021)
Download: https://tuxera.com/opensource/ntfs-3g_ntfsprogs-2017.3.23AR.6.tgz

Changelog:

• Used kernel cacheing on read-only mounts or with lowntfs-3g
• Avoided information leak when processing garbled compressed data
• Defined option posix_nlink to compute a Posix compliant st_nlink
• Recovered space when an index root is shortened
• Replaced ENODATA with ENOATTR in xattrs functions for macOS
• Added support for 'position' argument in macOS xattr functions
• Changed default xattr access method to 'openxattr' for macOS builds
• Allowed redefining the target location of the ntfsprogs tools
• Fixed updating the allocated size when attribute lies in an extent
• Enabled actions on directories in reparse plugins
• Inserted the reparse tag in the bad reparse symlink
• Supported use of WSL special files
• Dropped rejecting having both EA and reparse data
• Enabled Creating special files the same way as WSL
• Checked the locations of MFT and MFTMirr at startup

NTFS-3G 2017.3.23AR.5

Stable Version 2017.3.23AR.5 (April 1, 2020)

Changelog:

• Processed the request argument of ioctl() as unsigned
• Accepted alternative recording of cluster size
• Fixed a poorly sized string in ntfsinfo
• Fixed ntfsfallocate on a void file
• Decoded execlink reparse points
• Fixed object type returned in readdir() for reparse points
• Exported the translations of Windows paths to current ones

NTFS-3G 2017.3.23AR.4

Stable Version 2017.3.23AR.4 (March 1, 2019)

Changelog:

• Fixed reporting an error when failed to build the mountpoint
• Reverted accessing reparse directory through internal plugins
• Cleaned object ids beyond the updated part
• Fixed reacting to missing plugin
• Returned a low level error when an ioctl fails
• Truncated SSD trimming zones to granularity supported by the device

NTFS-3G 2017.3.23AR.3

Stable Version 2017.3.23AR.3 (September 1, 2018)

Changelog:

• Made sure log file buffers are properly aligned
• Made reparse directories visible through internal plugins
• Added an option to ntfscp to copy the modification time
• Renamed undeleted files to avoid overwriting existing ones
• Extended the allowed cluster size to 2MB
• Allocated full clusters for reading and rescuing in ntfsclone
• Prevented locally defined headers from interfering with ntfs-3g ones
• Attempted mounting read-only after failed permission to read-write
• Fixed collecting the label argument in mkntfs

NTFS-3G 2017.3.23AR.2

Stable Version 2017.3.23AR.2 (March 1, 2018)

Changelog:

• Made sure log file buffers are properly aligned
• Checked log file blocks more recent than temporary ones
• Processed redo log actions associated to undoing a CompensationlogRecord
• Allowed setting a file object id without defining its birth ids
• Documented read-only mount when Windows is hibernated
• Stopped checking matches of MFTMirr against MFT at record 16
• Filtered out reparse flags for selecting plugins
• Delayed updating the MFT runlist when resizing in read-only mode
• Double-checked whether record 15 is an extent of MFT
• Checked whether the device to mount was forced read-only