Threat Intelligence Database

A heap-based buffer overflow vulnerability exists in NTFS-3G through version 2026.2.25 in the build_inherited_id() function. This flaw can be triggered by creating a file in a specially crafted directory within a malicious NTFS image, potentially allowing heap memory corruption in the SUID-root ntfs-3g binary.

CVE-2026-56136 is an out-of-bounds read vulnerability in NTFS-3G through version 2026.2.25. It occurs in the ntfs_ir_nill() function within libntfs-3g/index.c and can be triggered by creating a file with a specially crafted name. This flaw allows an attacker with local access to read potentially confidential information from the memory of the ntfs-3g process. The vulnerability has a medium severity rating with a CVSS score of 4.7.

CVE-2026-40706 is a high-severity heap-based buffer overflow vulnerability in the Tuxera NTFS-3G driver version 2022.10.3 and earlier before 2026.2.25. The flaw exists in the ntfs_build_permissions_posix() function within acls.c and can be triggered by processing a malicious NTFS image containing specific security descriptors with multiple ACCESS_DENIED ACEs that include WRITE_OWNER from distinct group SIDs. This vulnerability affects the SUID-root ntfs-3g binary during file read operations such as stat, readdir, and open, potentially allowing heap memory corruption. No official patch or remediation guidance is currently available from the vendor. The vulnerability has a CVSS 3.