NTFS-3G CVE-2026-40706

|

EUVD

EUVD-2026-24467 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-21 mitre

Buffer Overflow Heap Overflow Ntfs 3G Tuxera

8.4

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Local, unprivileged attacker mounts a crafted image via the SUID-root helper without interaction; deterministic trigger gives AC:L, and root-context corruption yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

6

Source Code Evidence Fetched

Jul 24, 2026 - 07:11 vuln.today

Analysis Generated

Jul 24, 2026 - 07:11 vuln.today

Patch released

Apr 22, 2026 - 21:23 nvd

Patch available

Patch available

Apr 21, 2026 - 22:17 EUVD

EUVD ID Assigned

Apr 21, 2026 - 22:16 euvd

EUVD-2026-24467

CVE Published

Apr 21, 2026 - 00:00 nvd

HIGH 8.4

DescriptionCVE.org

In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.

AnalysisAI

Local privilege escalation in the SUID-root ntfs-3g binary (Tuxera NTFS-3G from 2022.10.3 up to before 2026.2.25) stems from a heap buffer overflow in ntfs_build_permissions_posix() in acls.c. An attacker who can present a malicious NTFS image corrupts heap memory during ordinary read operations (stat, readdir, open) that parse a security descriptor carrying multiple ACCESS_DENIED ACEs with WRITE_OWNER from distinct group SIDs, potentially yielding root code execution. No public exploit identified at time of analysis and EPSS is negligible (0.01%), but the technical impact is total.

Technical ContextAI

NTFS-3G is the FUSE-based open-source NTFS read/write driver widely used on Linux and other Unix-like systems, where its mount helper is commonly installed SUID-root so unprivileged users can mount NTFS volumes (e.g. removable media). The defect is CWE-122 (heap-based buffer overflow) inside ntfs_build_permissions_posix(), the routine that translates NTFS security descriptors into POSIX ACLs when POSIX ACL support is compiled/enabled. When the descriptor contains several ACCESS_DENIED ACEs bearing the WRITE_OWNER right sourced from distinct group SIDs, the code writes more POSIX ACL entries than the destination heap buffer was sized for, overflowing it. The CPE cpe:2.3:a:tuxera:ntfs-3g pins the affected component to Tuxera's ntfs-3g package; the upstream source lines are referenced at acls.c#L4011-L4027.

RemediationAI

Vendor-released patch: 2026.2.25 - upgrade NTFS-3G to 2026.2.25 or later (upstream release https://github.com/tuxera/ntfs-3g/releases/tag/2026.2.25, advisory https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-4cwv-5285-63v9), or apply your distribution's backported package (SUSE-SU-2026:1571 at https://www.suse.com/support/update/SUSE-SU-2026:1571/, or the Debian LTS update). Where immediate patching is not possible, reduce exposure by removing the SUID-root bit from the ntfs-3g mount helper so unprivileged users cannot invoke it (trade-off: breaks user-initiated NTFS mounts), disabling auto-mounting of removable media via udisks/udev policy so untrusted images are not parsed automatically (trade-off: users must mount manually as root), and restricting who may attach or mount external storage. If POSIX ACL support is not required, building/deploying NTFS-3G without POSIX ACLs avoids the vulnerable code path in ntfs_build_permissions_posix() (trade-off: loss of POSIX ACL translation on NTFS volumes).

More in Ntfs 3G

View all

CVE-2021-35266 HIGH This Week

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer

CVE-2021-35267 HIGH This Week

NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror all

CVE-2021-35269 HIGH This Week

NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_se

CVE-2021-33289 HIGH This Week

In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflo

CVE-2021-33286 HIGH This Week

In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer over

CVE-2021-35268 HIGH This Week

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a h

CVE-2021-33287 HIGH This Week

In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a he

CVE-2022-40284 HIGH This Week

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Rated high severity (CVSS 7.8), this vulnerability is low

CVE-2022-30789 HIGH This Week

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.

CVE-2022-30788 HIGH This Week

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22. Rated hi

CVE-2022-30786 HIGH This Week

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22. Rat

CVE-2022-30784 HIGH This Week

A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. Rated high seve

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

CVE-2023-27997 CRITICAL

CVE-2025-25249 CRITICAL POC

CVE-2026-85880 HIGH POC

CVE-2025-24985 HIGH POC

CVE-2026-53362 HIGH POC

CVE-2025-21418 HIGH

CVE-2023-23376 HIGH

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed

Share

CVE-2026-40706 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy