In version 4.8.0 and previous versions of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.
sleuthkit the sleuth kit