Skip to main content

NTFS-3G CVE-2026-56135

| EUVDEUVD-2026-65147 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-15 vendor:ubuntu
Buffer Overflow Heap Overflow
7.4
CVSS 3.1 · Vendor: vendor:ubuntu
Share

Severity by source

Vendor (vendor:ubuntu) PRIMARY
7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.4 HIGH

Local attack via crafted NTFS image (AV:L), high complexity to achieve reliable heap control (AC:H), SUID binary requires no attacker privileges (PR:N), full impact on successful exploitation.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Aug 28, 2026 - 20:41 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 28, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Aug 28, 2026 - 20:22 NVD
7.4 (HIGH)
Analysis Generated
Jul 16, 2026 - 16:32 vuln.today
CVE Published
Jul 15, 2026 - 00:00 cve.org
MEDIUM

DescriptionCVE.org

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

AnalysisAI

Heap-based buffer overflow in NTFS-3G through 2026.2.25 enables a local attacker to corrupt heap memory inside the SUID-root ntfs-3g binary by supplying a crafted NTFS image, with potential for privilege escalation to root. The flaw in build_inherited_id() (libntfs-3g/security.c) is triggered when a file is created inside a specially structured directory on the malicious volume. No public exploit identified at time of analysis; vendor patches are confirmed available for Ubuntu and SUSE.

Technical ContextAI

NTFS-3G is a FUSE-based, full read-write NTFS driver widely deployed on Linux and other UNIX-like systems, typically installed as a SUID-root binary to allow unprivileged users to mount NTFS volumes without root credentials. The vulnerable function build_inherited_id() in libntfs-3g/security.c is responsible for computing and inheriting NTFS security identifiers when new filesystem objects are created. CWE-122 (Heap-based Buffer Overflow) indicates that the function writes beyond the bounds of a heap-allocated buffer, which in the context of a SUID-root process creates conditions for heap metadata corruption and potential arbitrary code execution. The overflow is triggered through the filesystem semantics of creating a file inside a directory crafted to carry a malicious NTFS security descriptor inheritance chain.

RemediationAI

Apply the vendor-released patch immediately. Ubuntu users should upgrade the ntfs-3g package per USN-8554-1 at https://ubuntu.com/security/notices/USN-8554-1. SUSE users should apply SUSE-SU-2026:3213 or SUSE-SU-2026:3214 as applicable to their product line, available at the respective SUSE support URLs. The upstream fix is detailed in GHSA-c9qg-fh4v-mq8r at https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-c9qg-fh4v-mq8r. An exact fixed release version is not stated in the available input data; administrators should confirm the patched package version via their distribution's advisory. Where immediate patching is not feasible, removing the SUID bit from the ntfs-3g binary (chmod -s /usr/bin/ntfs-3g or equivalent) eliminates the privilege escalation path entirely - the trade-off is that unprivileged users will no longer be able to mount NTFS volumes without explicit sudo authorization. As an additional control, restricting which users or groups may invoke ntfs-3g via filesystem ACLs or sudo policy further limits the attack surface.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-56135 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy