Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Tuxera

First CVE: Apr 13, 2018Active for: 8 yearsTotal CVEs: 33
52.2
VTI Score
TOP TARGET

Tuxera maintains a narrow portfolio focused on the NTFS-3G filesystem driver, a widely embedded component in Linux systems and embedded devices that provides read-write access to Windows NTFS volumes. Despite its modest disclosure volume, the driver's privileged kernel-space role and deep integration across consumer and enterprise Linux deployments gives its vulnerabilities outsized impact; a single flaw can affect millions of systems that depend on the driver for cross-platform file sharing. The recurring weakness classes—improper input validation, out-of-bounds reads and writes, buffer overflows, and integer underflow conditions—reflect the complexity of parsing untrusted filesystem structures at the kernel boundary, where memory-safety lapses can escalate to privilege escalation or system instability. Defenders should treat NTFS-3G patches as high-priority for systems that require NTFS interoperability and consider whether the driver's use case justifies the kernel-level attack surface. Current exploitation activity, severity trends, and exposure counts are shown alongside this summary.

FAUCET AI Generated
33
Total CVEs
More Total CVEs than 98% of tracked vendors
6.6
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 98% of tracked vendors
7.6
Avg CVSS Score
Higher Avg CVSS Score than 72% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Tuxera over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 13, 2018
8 years ago
Most Recent CVE
Apr 21, 2026
94 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (33 CVEs).

33 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2017-0358HIGH
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A lo
Apr 13, 20187.841NOYES
CVE-2026-40706HIGH
In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntf
Apr 21, 20268.429NONO
CVE-2021-35266HIGH
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial o
Sep 7, 20217.828NONO
CVE-2021-35269HIGH
NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code
Sep 7, 20217.828NONO
CVE-2021-35268HIGH
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution an
Sep 7, 20217.828NONO
CVE-2021-33289HIGH
In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.
Sep 7, 20217.828NONO
CVE-2021-46790HIGH
ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by s
May 2, 20227.827NONO
CVE-2021-35267HIGH
NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when se
Sep 7, 20217.827NONO
CVE-2021-33287HIGH
In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitr
Sep 7, 20217.827NONO
CVE-2021-33286HIGH
In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.
Sep 7, 20217.827NONO
View all 33 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products33 CVEs
12%
88%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local33 (100.0%)
Network0 (0.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low32 (97.0%)
High1 (3.0%)
Unknown0 (0.0%)
User Interaction
None33 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low29 (87.9%)
High3 (9.1%)
None1 (3.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (33 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
3.0% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
3.0% of CVEs· 75th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Tuxera.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Tuxera — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Tuxera's Products

View all 2 CNAs →

Top CWEs