CVE-2023-52890
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE:...
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
CVE-2023-52890- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2023-59645
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
EUVD-2023-59645- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m8g6-3qqh-77pv
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE:...
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
GHSA-m8g6-3qqh-77pv- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
NVD
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
CVE-2023-52890- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSV
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
CVE-2023-52890- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-52890
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
DEBIAN-CVE-2023-52890- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2024-1739
ntfs-3g security update
NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.
Security Fix(es):
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.(CVE-2023-52890)
- Record
OESA-2024-1739- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-52890
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
UBUNTU-CVE-2023-52890- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVAZL-42652 No score
CVE-2023-52890 affecting package ntfs-3g for versions less than 2022.10.3-2
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
AZL-42652- Updated
- 2026-11-05
OSVAZL-42667 No score
CVE-2023-52890 affecting package ntfs-3g for versions less than 2022.10.3-2
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
- Record
AZL-42667- Updated
- 2026-11-02
OSVMGASA-2024-0284 No score
Updated ntfs-3g packages fix security vulnerability
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. (CVE-2023-52890)
- Record
MGASA-2024-0284- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14046-1 No score
libntfs-3g-devel-2022.10.3-4.1 on GA media
These are all security issues fixed in the libntfs-3g-devel-2022.10.3-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14046-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2074-1 No score
Security update for ntfs-3g_ntfsprogs
This update for ntfs-3g_ntfsprogs fixes the following issues:
- CVE-2023-52890: Fixed use-after-free in 'ntfs_uppercase_mbs' in unistr.c (bsc#1226007).
- Record
SUSE-SU-2024:2074-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2187-1 No score
Security update for ntfs-3g_ntfsprogs
This update for ntfs-3g_ntfsprogs fixes the following issue:
- CVE-2023-52890: fix a use after free in ntfs_uppercase_mbs (bsc#1226007)
- Record
SUSE-SU-2024:2187-1- Updated
- 2026-11-02
OSVUSN-8192-1 No score
ntfs-3g vulnerabilities
Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8 sequences. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-52890)
Andrea Bocchetti discovered that NTFS-3G incorrectly handled certain security descriptors. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. (CVE-2026-40706)
- Record
USN-8192-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntfs-3gAzure Linux:3 |
before 2022.10.3-2 | 2022.10.3-2 |
ntfs-3gAzure Linux:2 |
before 2022.10.3-2 | 2022.10.3-2 |
ntfs-3gDebian:12 |
before 1:2022.10.3-1+deb12u1, plus listed versions 1:2022.10.3-1 |
1:2022.10.3-1+deb12u1 |
ntfs-3gDebian:13 |
before 1:2022.10.3-3 | 1:2022.10.3-3 |
ntfs-3gDebian:14 |
before 1:2022.10.3-3 | 1:2022.10.3-3 |
ntfs-3gMageia:9 |
before 2022.10.3-1.1.mga9 | 2022.10.3-1.1.mga9 |
ntfs-3gopenEuler:20.03-LTS-SP4 |
before 2022.5.17-3.oe2003sp4 | 2022.5.17-3.oe2003sp4 |
ntfs-3gopenEuler:22.03-LTS-SP1 |
before 2022.5.17-3.oe2203sp1 | 2022.5.17-3.oe2203sp1 |
ntfs-3gopenEuler:22.03-LTS-SP3 |
before 2022.5.17-3.oe2203sp3 | 2022.5.17-3.oe2203sp3 |
ntfs-3gopenEuler:24.03-LTS |
before 2022.10.3-2.oe2403 | 2022.10.3-2.oe2403 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntfs-3g_ntfsprogsSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2022.5.17-5.20.1 | 2022.5.17-5.20.1 |
ntfs-3g_ntfsprogsSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 2022.5.17-5.20.1 | 2022.5.17-5.20.1 |
ntfs-3g_ntfsprogsSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 2022.5.17-150000.3.21.1 | 2022.5.17-150000.3.21.1 |
ntfs-3g_ntfsprogsSUSE:Linux Enterprise Module for Development Tools 15 SP6 |
before 2022.5.17-150000.3.21.1 | 2022.5.17-150000.3.21.1 |
ntfs-3g_ntfsprogsSUSE:Linux Enterprise Workstation Extension 15 SP5 |
before 2022.5.17-150000.3.21.1 | 2022.5.17-150000.3.21.1 |
ntfs-3g_ntfsprogsopenSUSE:Leap 15.5 |
before 2022.5.17-150000.3.21.1 | 2022.5.17-150000.3.21.1 |
ntfs-3g_ntfsprogsopenSUSE:Leap 15.6 |
before 2022.5.17-150000.3.21.1 | 2022.5.17-150000.3.21.1 |
ntfs-3gUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:2013.1.13AR.1-2ubuntu11:2013.1.13AR.1-2ubuntu21:2013.1.13AR.1-2ubuntu2+esm11:2013.1.13AR.1-2ubuntu2+esm21:2013.1.13AR.1-2ubuntu2+esm31:2013.1.13AR.1-2ubuntu2+esm4 |
None known |
ntfs-3gUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2014.2.15AR.3-31:2015.3.14AR.1-11:2015.3.14AR.1-1build11:2015.3.14AR.1-1ubuntu0.11:2015.3.14AR.1-1ubuntu0.2 Show 5 moreShow less1:2015.3.14AR.1-1ubuntu0.31:2015.3.14AR.1-1ubuntu0.3+esm11:2015.3.14AR.1-1ubuntu0.3+esm21:2015.3.14AR.1-1ubuntu0.3+esm31:2015.3.14AR.1-1ubuntu0.3+esm4 |
None known |
ntfs-3gUbuntu:18.04:LTS |
All versions, plus listed versions 1:2016.2.22AR.2-21:2017.3.23-21:2017.3.23-2ubuntu0.18.04.11:2017.3.23-2ubuntu0.18.04.21:2017.3.23-2ubuntu0.18.04.31:2017.3.23-2ubuntu0.18.04.41:2017.3.23-2ubuntu0.18.04.5 |
None known |
ntfs-3gUbuntu:20.04:LTS |
All versions, plus listed versions 1:2017.3.23AR.3-3ubuntu11:2017.3.23AR.3-3ubuntu1.11:2017.3.23AR.3-3ubuntu1.21:2017.3.23AR.3-3ubuntu1.3 |
None known |
ntfs-3gUbuntu:22.04:LTS |
before 1:2021.8.22-3ubuntu1.3, plus listed versions 1:2017.3.23AR.3-3ubuntu51:2017.3.23AR.3-3ubuntu61:2021.8.22-3ubuntu11:2021.8.22-3ubuntu1.11:2021.8.22-3ubuntu1.2 |
1:2021.8.22-3ubuntu1.3 |
ntfs-3gUbuntu:24.04:LTS |
before 1:2022.10.3-1.2ubuntu3.1, plus listed versions 1:2022.10.3-1ubuntu11:2022.10.3-1.2ubuntu11:2022.10.3-1.2ubuntu21:2022.10.3-1.2ubuntu3 |
1:2022.10.3-1.2ubuntu3.1 |
ntfs-3gUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1:2021.8.22-3ubuntu1.3, plus listed versions 1:2017.3.23AR.3-3ubuntu51:2017.3.23AR.3-3ubuntu61:2021.8.22-3ubuntu11:2021.8.22-3ubuntu1.11:2021.8.22-3ubuntu1.2 |
1:2021.8.22-3ubuntu1.3 |
ntfs-3gUbuntu:24.04:LTS From an advisory covering 2 CVEs |
before 1:2022.10.3-1.2ubuntu3.1, plus listed versions 1:2022.10.3-1ubuntu11:2022.10.3-1.2ubuntu11:2022.10.3-1.2ubuntu21:2022.10.3-1.2ubuntu3 |
1:2022.10.3-1.2ubuntu3.1 |
ntfs-3gUbuntu:25.10 From an advisory covering 2 CVEs |
before 1:2022.10.3-5ubuntu0.25.10.1, plus listed versions 1:2022.10.3-5 |
1:2022.10.3-5ubuntu0.25.10.1 |
ntfs-3g_ntfsprogsopenSUSE:Tumbleweed |
before 2022.10.3-4.1 | 2022.10.3-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-52890 is a medium vulnerability (CVSS 4.5) in ntfs-3g, published June 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in ntfs-3g 2022.10.3-2.
References
github.com/tuxera/ntfs-3g/issues/84
nvd.nist.gov/vuln/detail/CVE-2023-52890
security-tracker.debian.org/tracker/CVE-2023-52890
advisories.mageia.org/MGASA-2024-0284.html
Show 11 moreShow less
bugs.mageia.org/show_bug.cgi?id=33530
lists.opensuse.org/archives/list/[email protected]/message/M2T36ITNEMHD5DLL56EBYL7O4ORVVRLQ
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1739
suse.com/support/update/announcement/2024/suse-su-20242074-1
bugzilla.suse.com/1226007
ubuntu.com/security/CVE-2023-52890
cve.org/CVERecord?id=CVE-2023-52890