SB2026110582 - Multiple vulnerabilities in NTFS-3G

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110582

SB2026110582 - Multiple vulnerabilities in NTFS-3G

Published: November 5, 2026

Security Bulletin ID SB2026110582
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 22% Low 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-56136)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose potentially confidential information from an ntfs-3g process.

The vulnerability exists due to an out-of-bounds read in the ntfs_ir_nill() function in libntfs-3g/index.c when creating a file with a crafted name on a malicious NTFS image. A local user can craft a malicious NTFS image and trigger creation of a file with a crafted name to read potentially confidential information from the ntfs-3g process.


2) Heap-based buffer overflow (CVE-ID: CVE-2026-56135)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory in the SUID-root ntfs-3g binary.

The vulnerability exists due to a heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c when creating a file in a crafted NTFS directory. A remote attacker can craft a malicious NTFS image to corrupt heap memory when a file is created in the crafted directory.


3) Heap-based buffer overflow (CVE-ID: CVE-2026-46572)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory in the SUID-root ntfs-3g binary, potentially causing a denial of service or arbitrary code execution with elevated privileges.

The vulnerability exists due to a heap-based buffer overflow in ntfs_ib_cut_tail() in libntfs-3g/index.c when creating a file in a specially crafted directory. A remote attacker can craft a malicious NTFS image containing such a directory to trigger heap memory corruption when a file is created in it.


4) Heap-based buffer overflow (CVE-ID: CVE-2026-46570)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory, potentially causing a denial of service or arbitrary code execution with root privileges.

The vulnerability exists due to a heap-based buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c when reading specially crafted file metadata. A remote attacker can craft a malicious NTFS image to corrupt heap memory in the SUID-root ntfs-3g binary when its metadata is processed.


5) Out-of-bounds read (CVE-ID: CVE-2026-46571)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose potentially confidential information from NTFS-3G process memory.

The vulnerability exists due to an out-of-bounds read in ntfs_fix_file_name() in libntfs-3g/reparse.c when processing a readlink operation on a corrupted file. A local user can craft a malicious NTFS image that triggers the out-of-bounds read during this operation to disclose potentially confidential process memory.

The vulnerable behavior occurs when the ignore_case mount option is used.


6) Heap-based buffer overflow (CVE-ID: CVE-2026-46569)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory in the SUID-root ntfs-3g binary.

The vulnerability exists due to a heap-based buffer overflow caused by a missing range check in ntfs_ib_copy_tail() in libntfs-3g/index.c when extending a directory on a malicious NTFS image. A remote attacker can craft an NTFS image that triggers the overflow during directory extension, such as file creation, to corrupt heap memory in the SUID-root binary.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-42618)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary.

The vulnerability exists due to a heap-based buffer overflow in ntfs_decompress() in compress.c when reading a specially crafted compressed file from an NTFS image. A remote attacker can craft a malicious NTFS image to trigger a one-byte heap memory overwrite when the file is read.


8) Heap-based buffer overflow (CVE-ID: CVE-2026-42617)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory, potentially leading to arbitrary code execution with root privileges or a denial of service.

The vulnerability exists due to a heap-based buffer overflow in ntfs_ir_to_ib() in index.c when extending a directory on a malicious NTFS image. A remote attacker can craft an NTFS image and trigger directory extension, such as by creating a file, to corrupt heap memory in the SUID-root ntfs-3g binary.


9) Heap-based buffer overflow (CVE-ID: CVE-2026-42616)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory in ntfscat, potentially leading to arbitrary code execution or a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the cat() function in ntfscat.c when reading a file from a malicious NTFS image. A remote attacker can craft an NTFS image and induce a victim to read a file from it using ntfscat to corrupt heap memory, potentially leading to arbitrary code execution or a denial of service.


Remediation

Install update from vendor's website.

References