Every CVE Search/ Get API key

CVE-2026-56135

CVE-2026-56135 affecting package ntfs-3g for versions less than 2022.10.3-4

7.4 HighFix available

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.14%Unchanged since Aug 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
CVE-2026-56135
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-65147 7.4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
EUVD-2026-65147
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
CVE-2026-56135
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSV 7.4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
CVE-2026-56135
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56135 7.4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
DEBIAN-CVE-2026-56135
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVOESA-2026-3108 7.5

ntfs-3g security update

NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.

Security Fix(es):

(CVE-2026-42616)

(CVE-2026-42617)

(CVE-2026-42618)

(CVE-2026-46569)

(CVE-2026-46570)

(CVE-2026-46571)

(CVE-2026-46572)

(CVE-2026-56135)

(CVE-2026-56136)

Record
OESA-2026-3108
CVSS 4.0
7.5 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2026-56135 7.4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
UBUNTU-CVE-2026-56135
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-97932 No score

CVE-2026-56135 affecting package ntfs-3g for versions less than 2022.10.3-4

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Record
AZL-97932
Updated
2026-11-05
OSVMGASA-2026-0424 No score

Updated ntfs-3g packages fix security vulnerabilities

Heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616) Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617) Single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618) Heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569) Heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570) Out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571) Heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572) Heap buffer overflow when building inherited ACL data. (CVE-2026-56135) Out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)

Record
MGASA-2026-0424
Updated
2026-11-02
OSVopenSUSE-SU-2026:11320-1 No score

libntfs-3g-devel-2022.10.3-8.1 on GA media

These are all security issues fixed in the libntfs-3g-devel-2022.10.3-8.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11320-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21484-1 No score

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3g_ntfsprogs fixes the following issues:

  • CVE-2026-42616: heap buffer overflow in cat() of cat.c can lead to heap corruption in the ntfscat binary via a specially crafted NTFS image (bsc#1271102).
  • CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() of index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271103).
  • CVE-2026-42618: heap buffer overflow in ntfs_decompress() of compress.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271104).
  • CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() of libntfs-3g/index.ccan lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271105).
  • CVE-2026-46570: heap buffer overflow in ntfs_index_walk_down() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271106).
  • CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() of libntfs-3g/reparse.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271107).
  • CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271108).
  • CVE-2026-56135: heap-based buffer overflow in build_inherited_id() of libntfs-3g/security.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271109).
  • CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() of libntfs-3g/index.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271110).
Record
openSUSE-SU-2026:21484-1
Updated
2026-11-02
OSVSUSE-SU-2026:3213-1 No score

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3g_ntfsprogs fixes the following issues

  • CVE-2026-42616: heap buffer overflow in cat() in cat.c (bsc#1271102).
  • CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() in index.c (bsc#1271103).
  • CVE-2026-42618: heap buffer overflow in ntfs_decompress() in compress.c (bsc#1271104).
  • CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() in libntfs-3g/index.c (bsc#1271105).
  • CVE-2026-46570: heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c (bsc#1271106).
  • CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() in libntfs-3g/reparse.c (bsc#1271107).
  • CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() in libntfs-3g/index.c (bsc#1271108).
  • CVE-2026-56135: heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c (bsc#1271109).
  • CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() in libntfs-3g/index.c (bsc#1271110).
Record
SUSE-SU-2026:3213-1
Updated
2026-11-02
OSVSUSE-SU-2026:3214-1 No score

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3g_ntfsprogs fixes the following issues

  • CVE-2026-42616: heap buffer overflow in cat() of cat.c can lead to heap corruption in the ntfscat binary via a specially crafted NTFS image (bsc#1271102).
  • CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() of index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271103).
  • CVE-2026-42618: heap buffer overflow in ntfs_decompress() of compress.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271104).
  • CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() of libntfs-3g/index.ccan lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271105).
  • CVE-2026-46570: heap buffer overflow in ntfs_index_walk_down() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271106).
  • CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() of libntfs-3g/reparse.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271107).
  • CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() of libntfs-3g/index.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271108).
  • CVE-2026-56135: heap-based buffer overflow in build_inherited_id() of libntfs-3g/security.c can lead to heap corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271109).
  • CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() of libntfs-3g/index.c can lead to disclosure of confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image (bsc#1271110).
Record
SUSE-SU-2026:3214-1
Updated
2026-11-02
OSVUSN-8554-1 No score

ntfs-3g vulnerabilities

It was discovered that NTFS-3G had a heap buffer overflow when reading certain NTFS images. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2026-42616)

It was discovered that NTFS-3G had multiple heap buffer overflows when processing certain NTFS images. A local attacker could possibly use these issues to execute arbitrary code. (CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46572, CVE-2026-56135)

It was discovered that NTFS-3G had out-of-bounds reads when processing certain NTFS images. A local attacker could possibly use these issues to obtain sensitive information. (CVE-2026-46571, CVE-2026-56136)

Record
USN-8554-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ntfs-3g
Azure Linux:3
 before 2022.10.3-4
2022.10.3-4
ntfs-3g
Debian:12
 before 1:2022.10.3-1+deb12u4, plus listed versions
1:2022.10.3-11:2022.10.3-1+deb12u11:2022.10.3-1+deb12u21:2022.10.3-1+deb12u3
1:2022.10.3-1+deb12u4
ntfs-3g
Debian:13
 before 1:2022.10.3-5+deb13u2, plus listed versions
1:2022.10.3-51:2022.10.3-5+deb13u1
1:2022.10.3-5+deb13u2
ntfs-3g
Debian:14
 before 1:2026.7.7-2, plus listed versions
1:2022.10.3-51:2026.2.25-11:2026.7.7-1
1:2026.7.7-2
ntfs-3g
Mageia:10
From an advisory covering 9 CVEs
 before 2026.2.25-1.1.mga10
2026.2.25-1.1.mga10
ntfs-3g
Mageia:9
From an advisory covering 9 CVEs
 before 2022.10.3-1.3.mga9
2022.10.3-1.3.mga9
ntfs-3g
openEuler:24.03-LTS-SP1
From an advisory covering 9 CVEs
 before 2022.10.3-4.oe2403sp1
2022.10.3-4.oe2403sp1
ntfs-3g
openEuler:24.03-LTS-SP3
From an advisory covering 9 CVEs
 before 2022.10.3-4.oe2403sp3
2022.10.3-4.oe2403sp3
ntfs-3g
openEuler:24.03-LTS-SP4
From an advisory covering 9 CVEs
 before 2022.10.3-4.oe2403sp4
2022.10.3-4.oe2403sp4
ntfs-3g
openEuler:20.03-LTS-SP4
From an advisory covering 9 CVEs
 before 2022.5.17-5.oe2003sp4
2022.5.17-5.oe2003sp4
Show 19 moreShow less
Affected packages
PackageAffectedFixed
ntfs-3g
openEuler:22.03-LTS-SP4
From an advisory covering 9 CVEs
 before 2022.5.17-5.oe2203sp4
2022.5.17-5.oe2203sp4
ntfs-3g_ntfsprogs
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 2022.5.17-5.23.1
2022.5.17-5.23.1
ntfs-3g_ntfsprogs
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 2022.5.17-5.23.1
2022.5.17-5.23.1
ntfs-3g_ntfsprogs
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 9 CVEs
 before 2022.5.17-150000.3.27.1
2022.5.17-150000.3.27.1
ntfs-3g_ntfsprogs
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 9 CVEs
 before 2022.5.17-150000.3.27.1
2022.5.17-150000.3.27.1
ntfs-3g_ntfsprogs
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 2022.5.17-150000.3.27.1
2022.5.17-150000.3.27.1
ntfs-3g_ntfsprogs
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 2022.5.17-150000.3.27.1
2022.5.17-150000.3.27.1
ntfs-3g
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:2013.1.13AR.1-2ubuntu11:2013.1.13AR.1-2ubuntu21:2013.1.13AR.1-2ubuntu2+esm11:2013.1.13AR.1-2ubuntu2+esm21:2013.1.13AR.1-2ubuntu2+esm31:2013.1.13AR.1-2ubuntu2+esm4
 None known
ntfs-3g
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:2014.2.15AR.3-31:2015.3.14AR.1-11:2015.3.14AR.1-1build11:2015.3.14AR.1-1ubuntu0.11:2015.3.14AR.1-1ubuntu0.2
Show 5 moreShow less
1:2015.3.14AR.1-1ubuntu0.31:2015.3.14AR.1-1ubuntu0.3+esm11:2015.3.14AR.1-1ubuntu0.3+esm21:2015.3.14AR.1-1ubuntu0.3+esm31:2015.3.14AR.1-1ubuntu0.3+esm4
 None known
ntfs-3g
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:2016.2.22AR.2-21:2017.3.23-21:2017.3.23-2ubuntu0.18.04.11:2017.3.23-2ubuntu0.18.04.21:2017.3.23-2ubuntu0.18.04.31:2017.3.23-2ubuntu0.18.04.41:2017.3.23-2ubuntu0.18.04.5
 None known
ntfs-3g
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:2017.3.23AR.3-3ubuntu11:2017.3.23AR.3-3ubuntu1.11:2017.3.23AR.3-3ubuntu1.21:2017.3.23AR.3-3ubuntu1.3
 None known
ntfs-3g
Ubuntu:22.04:LTS
 before 1:2021.8.22-3ubuntu1.4, plus listed versions
1:2017.3.23AR.3-3ubuntu51:2017.3.23AR.3-3ubuntu61:2021.8.22-3ubuntu11:2021.8.22-3ubuntu1.11:2021.8.22-3ubuntu1.21:2021.8.22-3ubuntu1.3
1:2021.8.22-3ubuntu1.4
ntfs-3g
Ubuntu:24.04:LTS
 before 1:2022.10.3-1.2ubuntu3.2, plus listed versions
1:2022.10.3-1ubuntu11:2022.10.3-1.2ubuntu11:2022.10.3-1.2ubuntu21:2022.10.3-1.2ubuntu31:2022.10.3-1.2ubuntu3.1
1:2022.10.3-1.2ubuntu3.2
ntfs-3g
Ubuntu:26.04:LTS
 before 1:2022.10.3-5ubuntu1.1, plus listed versions
1:2022.10.3-51:2022.10.3-5build11:2022.10.3-5ubuntu1
1:2022.10.3-5ubuntu1.1
ntfs-3g
Ubuntu:22.04:LTS
From an advisory covering 9 CVEs
 before 1:2021.8.22-3ubuntu1.4, plus listed versions
1:2017.3.23AR.3-3ubuntu51:2017.3.23AR.3-3ubuntu61:2021.8.22-3ubuntu11:2021.8.22-3ubuntu1.11:2021.8.22-3ubuntu1.21:2021.8.22-3ubuntu1.3
1:2021.8.22-3ubuntu1.4
ntfs-3g
Ubuntu:24.04:LTS
From an advisory covering 9 CVEs
 before 1:2022.10.3-1.2ubuntu3.2, plus listed versions
1:2022.10.3-1ubuntu11:2022.10.3-1.2ubuntu11:2022.10.3-1.2ubuntu21:2022.10.3-1.2ubuntu31:2022.10.3-1.2ubuntu3.1
1:2022.10.3-1.2ubuntu3.2
ntfs-3g
Ubuntu:26.04:LTS
From an advisory covering 9 CVEs
 before 1:2022.10.3-5ubuntu1.1, plus listed versions
1:2022.10.3-51:2022.10.3-5build11:2022.10.3-5ubuntu1
1:2022.10.3-5ubuntu1.1
ntfs-3g_ntfsprogs
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 2022.10.3-8.1
2022.10.3-8.1
ntfs-3g_ntfsprogs
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2022.10.3-160000.4.1
2022.10.3-160000.4.1

History

History
RecordedChangedSources
affectedOSV
affected
factsOSV
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56135 is a high vulnerability (CVSS 7.4) in Tuxera Ntfs-3g, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in ntfs-3g 2022.10.3-4.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open