ZDI Discloses Three Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerabilities

ZDI published three advisories on 2026-09-14 for out-of-bounds read flaws in the Linux Kernel NTFS3 driver — ZDI-26-697 (CVSS 7.3), ZDI-26-698 (CVSS 5.2), and ZDI-26-699 (CVSS 5.2) — all allowing local low-privileged attackers to disclose sensitive…

Three advisories from the Zero Day Initiative, all dated 2026-09-14, describe out-of-bounds read vulnerabilities in the Linux Kernel NTFS3 driver: ZDI-26-697 is rated CVSS 7.3, while ZDI-26-698 and ZDI-26-699 are each rated CVSS 5.2. In every case, exploitation requires the attacker to first obtain the ability to execute low-privileged code on the target system, and successful exploitation results in local disclosure of sensitive information — no other impact is described. None of the three advisories list a CVE identifier. The reports are consistent on all details except the CVSS scores, where ZDI-26-697 (7.3) is rated higher than the other two (5.2).

• Three ZDI advisories dated 2026-09-14: ZDI-26-697, ZDI-26-698, and ZDI-26-699
• All three flaws are out-of-bounds reads in the Linux Kernel NTFS3 driver
• CVSS scores: ZDI-26-697 rated 7.3; ZDI-26-698 and ZDI-26-699 each rated 5.2
• All three enable local information disclosure of sensitive information only
• Exploitation of each flaw requires prior ability to execute low-privileged code on the target system
• No CVE identifiers are listed in any of the three advisories