ntfsx is at 0.1.0. Only the tip of main is supported; there is no backport branch. Fixes land there and go out in the next release.

Do not open a public issue for a security problem.

Report it privately through GitHub's private vulnerability reporting on this repository. If that is unavailable to you, open a public issue containing only "security report, please provide a contact address" and nothing else, and a private channel will be arranged.

Expect an acknowledgement within a week. If a report turns into a fix, you will be credited in CHANGELOG.md unless you ask not to be.

ntfsx parses NTFS structures from media that may be damaged, malicious, or simply written by an implementation we have never seen, and it does so as root, against a raw block device. The threat model is a hostile disk image or USB stick handed to a user who runs ntfsx on it.

In scope:

• Any input — an image file, a partition, a USB device — that makes ntfsx panic, hang, loop forever, or read or write outside the volume it was pointed at.
• Memory-safety failures of any kind. unsafe is confined to src/dev.rs, src/menu.rs and a handful of libc calls in src/main.rs and src/write.rs; a soundness bug in any of them is a security bug.
• A write path that corrupts a volume in a way ntfsx check --fix cannot detect, since silent corruption defeats the whole recovery story.
• Anything that causes ntfsx to write to a device other than the one named on the command line, or to write to a mounted volume despite the mount check.

Out of scope:

• Needing sudo to write a raw device. That is the design.
• --force overriding the dirty-flag and hibernation refusals. That flag exists to be an override and says so.
• Damage caused by pulling the cable mid-write. That is the documented recovery path (ntfsx check --fix), not a vulnerability — unless the result is undetectable by check, which is in scope.
• Bugs in ntfs-3g, which the test suite invokes as an external oracle and does not link.

Every field read off the volume is untrusted input. The rules the code holds to are in docs/architecture.md: bounds-check everything, reject implausible geometry, never unwrap on parsed on-disk data, and never panic. tests/fuzz.sh exists to catch violations, and past defects it found were an attribute name sliced past its own end and an $MFT claiming 88 TiB.