{"id":"CVE-2026-40706","aliases":["ALPINE-CVE-2026-40706","AZL-83181","DEBIAN-CVE-2026-40706","EUVD-2026-24467","GHSA-4cwv-5285-63v9","MGASA-2026-0118","OESA-2026-2100","OESA-2026-2101","OESA-2026-2102","OESA-2026-2103","OESA-2026-2104","SUSE-SU-2026:1571-1","SUSE-SU-2026:21432-1","UBUNTU-CVE-2026-40706","USN-8192-1","USN-8192-2","openSUSE-SU-2026:10614-1","openSUSE-SU-2026:20651-1"],"status":"published","title":"CVE-2026-40706 affecting package ntfs-3g for versions less than 2022.10.3-3","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00165,"percentile":0.05768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-04-21T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"ntfs-3g","fixed_in":["2026.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ntfs-3g","fixed_in":["2026.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ntfs-3g","fixed_in":["2026.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ntfs-3g","fixed_in":["2026.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ntfs-3g","fixed_in":["2026.2.25-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ntfs-3g","fixed_in":["2022.10.3-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ntfs-3g","fixed_in":["1:2022.10.3-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ntfs-3g","fixed_in":["1:2022.10.3-5+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ntfs-3g","fixed_in":["1:2026.2.25-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"ntfs-3g","fixed_in":["2022.10.3-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ntfs-3g","fixed_in":["2022.10.3-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"ntfs-3g","fixed_in":["2022.10.3-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ntfs-3g","fixed_in":["2022.5.17-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"ntfs-3g","fixed_in":["2022.5.17-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ntfs-3g","fixed_in":["2022.10.3-3.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ntfs-3g_ntfsprogs","fixed_in":["2022.5.17-150000.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"ntfs-3g_ntfsprogs","fixed_in":["2022.5.17-150000.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ntfs-3g_ntfsprogs","fixed_in":["2022.5.17-150000.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ntfs-3g_ntfsprogs","fixed_in":["2022.5.17-150000.3.24.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ntfs-3g","fixed_in":["1:2021.8.22-3ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ntfs-3g","fixed_in":["1:2022.10.3-1.2ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ntfs-3g","fixed_in":["1:2022.10.3-5ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ntfs-3g","fixed_in":["1:2022.10.3-5ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ntfs-3g_ntfsprogs","fixed_in":["2022.10.3-6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.25-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.10.3-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-1+deb12u3"}]}],"versions":["1:2022.10.3-1","1:2022.10.3-1+deb12u1","1:2022.10.3-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-5+deb13u1"}]}],"versions":["1:2022.10.3-5"]},{"source":"osv","ecosystem":"Debian:14","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2026.2.25-1"}]}],"versions":["1:2022.10.3-5"]},{"source":"osv","ecosystem":"Mageia:9","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.10.3-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.10.3-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.10.3-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.5.17-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.5.17-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.10.3-3.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.5.17-150000.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.5.17-150000.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.5.17-150000.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.5.17-150000.3.24.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2013.1.13AR.1-2ubuntu1","1:2013.1.13AR.1-2ubuntu2","1:2013.1.13AR.1-2ubuntu2+esm1","1:2013.1.13AR.1-2ubuntu2+esm2","1:2013.1.13AR.1-2ubuntu2+esm3","1:2013.1.13AR.1-2ubuntu2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2014.2.15AR.3-3","1:2015.3.14AR.1-1","1:2015.3.14AR.1-1build1","1:2015.3.14AR.1-1ubuntu0.1","1:2015.3.14AR.1-1ubuntu0.2","1:2015.3.14AR.1-1ubuntu0.3","1:2015.3.14AR.1-1ubuntu0.3+esm1","1:2015.3.14AR.1-1ubuntu0.3+esm2","1:2015.3.14AR.1-1ubuntu0.3+esm3","1:2015.3.14AR.1-1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2016.2.22AR.2-2","1:2017.3.23-2","1:2017.3.23-2ubuntu0.18.04.1","1:2017.3.23-2ubuntu0.18.04.2","1:2017.3.23-2ubuntu0.18.04.3","1:2017.3.23-2ubuntu0.18.04.4","1:2017.3.23-2ubuntu0.18.04.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2017.3.23AR.3-3ubuntu1","1:2017.3.23AR.3-3ubuntu1.1","1:2017.3.23AR.3-3ubuntu1.2","1:2017.3.23AR.3-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2021.8.22-3ubuntu1.3"}]}],"versions":["1:2017.3.23AR.3-3ubuntu5","1:2017.3.23AR.3-3ubuntu6","1:2021.8.22-3ubuntu1","1:2021.8.22-3ubuntu1.1","1:2021.8.22-3ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-1.2ubuntu3.1"}]}],"versions":["1:2022.10.3-1ubuntu1","1:2022.10.3-1.2ubuntu1","1:2022.10.3-1.2ubuntu2","1:2022.10.3-1.2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-5ubuntu0.25.10.1"}]}],"versions":["1:2022.10.3-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-5ubuntu1"}]}],"versions":["1:2022.10.3-5","1:2022.10.3-5build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2021.8.22-3ubuntu1.3"}]}],"versions":["1:2017.3.23AR.3-3ubuntu5","1:2017.3.23AR.3-3ubuntu6","1:2021.8.22-3ubuntu1","1:2021.8.22-3ubuntu1.1","1:2021.8.22-3ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-1.2ubuntu3.1"}]}],"versions":["1:2022.10.3-1ubuntu1","1:2022.10.3-1.2ubuntu1","1:2022.10.3-1.2ubuntu2","1:2022.10.3-1.2ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-5ubuntu0.25.10.1"}]}],"versions":["1:2022.10.3-5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2022.10.3-5ubuntu1"}]}],"versions":["1:2022.10.3-5","1:2022.10.3-5build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.10.3-6.1"}]}]}],"products":[{"vendor":"tuxera","product":"ntfs-3g"}],"references":[{"url":"https://github.com/tuxera/ntfs-3g/blob/d3ace19838ce37cfde55294e76841e6d2f393f9e/libntfs-3g/acls.c#L4011-L4027","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/21/4","tags":["web"]},{"url":"https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-4cwv-5285-63v9","tags":["advisory","report"]},{"url":"https://github.com/tuxera/ntfs-3g/releases/tag/2026.2.25","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00024.html","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/21/4","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40706","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40706.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40706","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0118.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35412","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00131.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2100","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2101","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2102","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2103","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2104","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261571-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262216","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40706","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621432-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40706","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8192-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8192-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-52890","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40706","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T00:00:00Z","modified":"2026-04-22T15:35:30.245Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-24467","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T00:00:00Z","modified":"2026-04-22T15:35:30Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:20.283712Z"}],"nvd":[{"id":"CVE-2026-40706","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T22:16:19.077Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"ALPINE-CVE-2026-40706","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T22:16:19.077Z","modified":"2026-10-01T02:17:49.279921769Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-40706","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T00:00:00Z","modified":"2026-10-28T02:30:41.076195928Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40706","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T22:16:19.077Z","modified":"2026-10-27T09:47:31.949462714Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2100","title":"ntfs-3g security update","description":"NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.\r\n\r\nSecurity Fix(es):\n\nA heap buffer overflow exists in ntfs_build_permissions_posix() (acls.c:4011-4027) that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.\n\nThe overflow size is attacker-controlled (8 to 14,000+ bytes) and writes partially attacker-controlled data (POSIX_ACE entries with attacker-derived GID values) past the heap allocation. This corrupts adjacent glibc heap chunk metadata, as confirmed by a crash in _int_free() with \u0026quot;free(): corrupted unsorted chunks\u0026quot;.(CVE-2026-40706)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:49.611340693Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2101","title":"ntfs-3g security update","description":"NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.\r\n\r\nSecurity Fix(es):\n\nA heap buffer overflow exists in ntfs_build_permissions_posix() (acls.c:4011-4027) that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.\n\nThe overflow size is attacker-controlled (8 to 14,000+ bytes) and writes partially attacker-controlled data (POSIX_ACE entries with attacker-derived GID values) past the heap allocation. This corrupts adjacent glibc heap chunk metadata, as confirmed by a crash in _int_free() with \u0026quot;free(): corrupted unsorted chunks\u0026quot;.(CVE-2026-40706)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:49.62110075Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2102","title":"ntfs-3g security update","description":"NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.\r\n\r\nSecurity Fix(es):\n\nA heap buffer overflow exists in ntfs_build_permissions_posix() (acls.c:4011-4027) that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.\n\nThe overflow size is attacker-controlled (8 to 14,000+ bytes) and writes partially attacker-controlled data (POSIX_ACE entries with attacker-derived GID values) past the heap allocation. This corrupts adjacent glibc heap chunk metadata, as confirmed by a crash in _int_free() with \u0026quot;free(): corrupted unsorted chunks\u0026quot;.(CVE-2026-40706)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:49.806003116Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2103","title":"ntfs-3g security update","description":"NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.\r\n\r\nSecurity Fix(es):\n\nA heap buffer overflow exists in ntfs_build_permissions_posix() (acls.c:4011-4027) that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.\n\nThe overflow size is attacker-controlled (8 to 14,000+ bytes) and writes partially attacker-controlled data (POSIX_ACE entries with attacker-derived GID values) past the heap allocation. This corrupts adjacent glibc heap chunk metadata, as confirmed by a crash in _int_free() with \u0026quot;free(): corrupted unsorted chunks\u0026quot;.(CVE-2026-40706)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:49.661234614Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2104","title":"ntfs-3g security update","description":"NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.\r\n\r\nSecurity Fix(es):\n\nA heap buffer overflow exists in ntfs_build_permissions_posix() (acls.c:4011-4027) that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.\n\nThe overflow size is attacker-controlled (8 to 14,000+ bytes) and writes partially attacker-controlled data (POSIX_ACE entries with attacker-derived GID values) past the heap allocation. This corrupts adjacent glibc heap chunk metadata, as confirmed by a crash in _int_free() with \u0026quot;free(): corrupted unsorted chunks\u0026quot;.(CVE-2026-40706)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:49.730967007Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2026-40706","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T12:00:00Z","modified":"2026-05-20T16:25:40.642361422Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-83181","title":"CVE-2026-40706 affecting package ntfs-3g for versions less than 2022.10.3-3","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.","status":"published","published":"2026-04-21T22:16:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"MGASA-2026-0118","title":"Updated ntfs-3g packages fix security vulnerability","description":"In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in\nntfs_build_permissions_posix() in acls.c that allows an attacker to\ncorrupt heap memory in the SUID-root ntfs-3g binary by crafting a\nmalicious NTFS image. The overflow is triggered on the READ path (stat,\nreaddir, open) when processing a security descriptor with multiple\nACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.\n(CVE-2026-40706)\n","status":"published","published":"2026-05-07T05:06:13Z","modified":"2026-05-07T05:15:30.123205Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10614-1","title":"libntfs-3g-devel-2022.10.3-6.1 on GA media","description":"These are all security issues fixed in the libntfs-3g-devel-2022.10.3-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-25T00:00:00Z","modified":"2026-04-26T09:45:14.928737Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20651-1","title":"Security update for ntfs-3g_ntfsprogs","description":"This update for ntfs-3g_ntfsprogs fixes the following issue:\n\n- CVE-2026-40706: heap buffer overflow in ntfs_build_permissions_posix() in acls.c (bsc#1262216).\n","status":"published","published":"2026-04-29T14:19:47Z","modified":"2026-05-01T18:27:09.847544Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1571-1","title":"Security update for ntfs-3g_ntfsprogs","description":"This update for ntfs-3g_ntfsprogs fixes the following issue:\n\n- CVE-2026-40706: heap buffer overflow in ntfs_build_permissions_posix() in acls.c (bsc#1262216).\n","status":"published","published":"2026-04-23T15:52:09Z","modified":"2026-04-24T08:16:00.940552Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21432-1","title":"Security update for ntfs-3g_ntfsprogs","description":"This update for ntfs-3g_ntfsprogs fixes the following issue:\n\n- CVE-2026-40706: heap buffer overflow in ntfs_build_permissions_posix() in acls.c (bsc#1262216).\n","status":"published","published":"2026-04-29T14:20:44Z","modified":"2026-05-05T18:23:50.430033Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8192-1","title":"ntfs-3g vulnerabilities","description":"Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8\nsequences. An attacker could use this issue to cause NTFS-3G to crash,\nresulting in a denial of service, or to execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-52890)\n\nAndrea Bocchetti discovered that NTFS-3G incorrectly handled certain\nsecurity descriptors. An attacker could use this issue to cause NTFS-3G to\ncrash, resulting in a denial of service, or to execute arbitrary code.\n(CVE-2026-40706)","status":"published","published":"2026-04-21T15:34:30Z","modified":"2026-04-27T18:42:30.211911Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8192-2","title":"ntfs-3g vulnerabilities","description":"USN-8192-1 fixed vulnerabilities in NTFS-3G. This update provides the\ncorresponding update to Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8\n sequences. An attacker could use this issue to cause NTFS-3G to crash,\n resulting in a denial of service, or to execute arbitrary code. This issue\n only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-52890)\n\n Andrea Bocchetti discovered that NTFS-3G incorrectly handled certain\n security descriptors. An attacker could use this issue to cause NTFS-3G to\n crash, resulting in a denial of service, or to execute arbitrary code.\n (CVE-2026-40706)","status":"published","published":"2026-04-27T11:33:03Z","modified":"2026-05-20T16:04:00.738380176Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}