CVE-2022-30787

An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.

• CWE-191

• http://www.openwall.com/lists/oss-security/2022/06/07/4Mailing List, Third Party Advisory
• https://github.com/tuxera/ntfs-3g/releasesRelease Notes, Third Party Advisory
• https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/06/msg00017.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
• https://security.gentoo.org/glsa/202301-01Third Party Advisory
• https://www.debian.org/security/2022/dsa-5160Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/06/07/4Mailing List, Third Party Advisory
• https://github.com/tuxera/ntfs-3g/releasesRelease Notes, Third Party Advisory
• https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/06/msg00017.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
• https://security.gentoo.org/glsa/202301-01Third Party Advisory
• https://www.debian.org/security/2022/dsa-5160Third Party Advisory

Published

May 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30781Gitea before 1.16.7 does not escape git fetch remote.7.5
• CVE-2022-30782Openmoney API through 2020-06-29 uses the JavaScript Math.ra…7.5
• CVE-2022-30783An invalid return code in fuse_kern_mount enables intercepti…6.7
• CVE-2022-30784A crafted NTFS image can cause heap exhaustion in ntfs_get_a…7.8
• CVE-2022-30785A file handle created in fuse_lib_opendir, and later used in…6.7
• CVE-2022-30786A crafted NTFS image can cause a heap-based buffer overflow …7.8
• CVE-2022-30788A crafted NTFS image can cause a heap-based buffer overflow …7.8
• CVE-2022-30789A crafted NTFS image can cause a heap-based buffer overflow …7.8
• CVE-2022-3079Festo control block CPX-CEC-C1 and CPX-CMXX in multiple vers…7.5
• CVE-2022-30790Das U-Boot 2022.01 has a Buffer Overflow, a different issue …7.8
• CVE-2022-30791In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncont…7.5
• CVE-2022-30792In CmpChannelServer of CODESYS V3 in multiple versions an un…7.5