Skip to main content

NTFS-3G CVE-2026-56136

| EUVDEUVD-2026-65148 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-15 vendor:ubuntu
Buffer Overflow Information Disclosure
4.7
CVSS 3.1 · Vendor: vendor:ubuntu
Share

Severity by source

Vendor (vendor:ubuntu) PRIMARY
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
3.3 LOW

Local delivery of a crafted image requires UI:R to mount; read-only memory leak yields C:L with no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
CVSS changed
Aug 28, 2026 - 20:22 NVD
4.7 (MEDIUM)
Analysis Generated
Jul 16, 2026 - 16:32 vuln.today

DescriptionCVE.org

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.

AnalysisAI

Out-of-bounds read in NTFS-3G through version 2026.2.25 exposes ntfs-3g process memory when a maliciously crafted NTFS image is mounted and a file with a specially crafted name is created on it. The flaw in ntfs_ir_nill() within the index-handling code allows an attacker who controls the filesystem image to read data from the running ntfs-3g process that may include confidential in-memory contents. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; this issue was surfaced by the Ubuntu security team.

Technical ContextAI

NTFS-3G is a mature open-source userspace NTFS driver, shipped by default in Ubuntu, Debian, Fedora, and most other Linux distributions to provide read/write access to Microsoft NTFS-formatted volumes. The vulnerable function ntfs_ir_nill() in libntfs-3g/index.c is responsible for handling NTFS index records - the on-disk structures that represent directory entries and file-name indexes (analogous to B-tree nodes). When processing index data derived from a crafted NTFS image during file-creation operations involving a specially formed filename, the function performs an out-of-bounds read beyond the allocated buffer boundary. Although no CWE is formally assigned in the available data, this is a classic CWE-125 (Out-of-bounds Read) pattern: externally supplied filesystem metadata is parsed without sufficient bounds enforcement, allowing the read pointer to stray into adjacent memory. Affected versions are all releases through 2026.2.25.

RemediationAI

The primary remediation is to upgrade to an NTFS-3G release newer than 2026.2.25 once a patched version is published by the upstream project or packaged by the relevant Linux distribution. As of this analysis, an exact patched release version has not been confirmed from the available input data - check the upstream NTFS-3G project repository and the Ubuntu Security Notices (USN) page for the precise fixed package version. As a compensating control, restrict mounting of externally sourced or untrusted NTFS images to isolated, non-privileged environments or dedicated forensic systems where process memory exposure has limited impact. Disabling automatic NTFS volume auto-mounting (e.g., via udev rules or disabling udisks2 auto-mount for removable media) removes the most common untrusted-image attack path, though it affects usability for end users. Environments that do not handle external NTFS volumes have negligible exposure and can deprioritize this issue.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

Share

CVE-2026-56136 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy