CVE-2021-39262:

CVE-2021-39262 is a vulnerability, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.42% probability of exploitation activity in the next 30 days, higher than 36% of all scored vulnerabilities. Microsoft released the fix on 15 December 2021 in the December 2021 Patch Tuesday. It affects 2 products in 1 product family (Mariner).

Key facts

CVE ID: CVE-2021-39262
Severity: High CVSS 7.8
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-787; CWE-20
EPSS: 0.42% (percentile 36%)
CISA KEV: Not listed
Released: 15 December 2021
Last updated: 15 December 2021
Patch Tuesday: December 2021 Patch Tuesday
Product families: Mariner

CVSS score and vector

Microsoft scores CVE-2021-39262 at 7.8 (temporal 7.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Metric	Value
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Affected products (2)

Mariner

Product	Security update	Type	Fixed build	Restart
CBL Mariner 2.0 x64	ntfs-3g	CBL-Mariner	2021.8.22-1
CBL Mariner 2.0 ARM	ntfs-3g	CBL-Mariner	2021.8.22-1

NIST NVD data

NVD status: Modified
NVD CVSS: 7.8 (HIGH)
NVD weakness: CWE-787; CWE-20
Published to NVD: 7 September 2021
NVD last modified: 17 June 2026

Affected configurations (CPE)

Product	Vulnerable versions
ntfs-3g	before 2021.8.22
debian linux 9.0	all listed versions
debian linux 10.0	all listed versions
debian linux 11.0	all listed versions

References

https://github.com/tuxera/ntfs-3g/releases (Release Notes, Third Party Advisory)
https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp (Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html (Mailing List, Third Party Advisory)
https://security.gentoo.org/glsa/202301-01 (Third Party Advisory)
https://www.debian.org/security/2021/dsa-4971 (Third Party Advisory)
https://github.com/tuxera/ntfs-3g/releases (Release Notes, Third Party Advisory)
https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp (Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html (Mailing List, Third Party Advisory)
https://security.gentoo.org/glsa/202301-01 (Third Party Advisory)
https://www.debian.org/security/2021/dsa-4971 (Third Party Advisory)

Revision history

Version	Date	Description
1.0	15 December 2021	Information published.