diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46571.patch b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46571.patch
new file mode 100644
index 0000000000..b2739f026e
--- /dev/null
+++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46571.patch
@@ -0,0 +1,50 @@
+From fc32321c8c795e9f73cbdd8f36fcd9e0a3a9814b Mon Sep 17 00:00:00 2001
+From: Rakesh Pandit <rakesh@tuxera.com>
+Date: Mon, 8 Jun 2026 14:16:39 +0300
+Subject: [PATCH] reparse.c: Bounds-check locase index in ntfs_fix_file_name.
+
+The case-insensitive branch indexed vol->locase with a raw 16-bit code
+point and no check against vol->upcase_len.  A truncated $UpCase made
+the table shorter than 65536 entries, so a file name character >=
+upcase_len read past it and leaked 2 heap bytes via the symlink target
+returned to userspace.
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
+issue.
+
+CVE: CVE-2026-46571
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea]
+
+(cherry picked from commit b912272b30c552b0457e40a0a68b1fac2587aaea)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ libntfs-3g/reparse.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/libntfs-3g/reparse.c b/libntfs-3g/reparse.c
+index 76dbe2f1..54858caa 100644
+--- a/libntfs-3g/reparse.c
++++ b/libntfs-3g/reparse.c
+@@ -196,11 +196,19 @@ static u64 ntfs_fix_file_name(ntfs_inode *dir_ni, ntfschar *uname,
+ 				lemref = entry->indexed_file;
+ 				mref = le64_to_cpu(lemref);
+ 				if (NVolCaseSensitive(vol) || !vol->locase) {
+-					for (i=0; i<found->file_name_length; i++)
++					for (i=0; i<found->file_name_length;
++							i++)
+ 						uname[i] = found->file_name[i];
+ 				} else {
+-					for (i=0; i<found->file_name_length; i++)
+-						uname[i] = vol->locase[le16_to_cpu(found->file_name[i])];
++					for (i=0; i<found->file_name_length;
++							i++) {
++						u16 u = le16_to_cpu(found->
++								file_name[i]);
++						uname[i] = (u < vol->upcase_len)
++								? vol->locase[u]
++								: found->
++								  file_name[i];
++					}
+ 				}
+ 			}
+ 		}
diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
index 8995807d95..c6517581b8 100644
--- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
+++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
@@ -11,6 +11,7 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
            file://CVE-2026-46572_CVE-2026-42617_p1.patch \
            file://CVE-2026-46572_CVE-2026-42617_p2.patch \
            file://CVE-2026-46572_CVE-2026-42617_p3.patch \
+           file://CVE-2026-46571.patch \
 "
 S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
 SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"