CVE-2026-56135

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_cut_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the cat() function in cat.c. An attacker can exploit this by crafting a malicious NTFS image that, when a file is read, corrupts heap memory in the ntfscat binary.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ir_to_ib() function in index.c. An attacker can exploit this by crafting a malicious NTFS image that, when mounted and a directory is extended (e.g., by creating a file), corrupts heap memory in the SUID-root ntfs-3g binary.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_decompress() in compress.c allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image and reading a specially crafted file.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_copy_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_fix_file_name() function in libntfs-3g/reparse.c. An attacker can exploit this by crafting a malicious NTFS image, leading to the disclosure of confidential information from ntfs-3g process memory when a readlink is performed on a corrupted reparse point.

In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_ir_nill() function in libntfs-3g/index.c. An attacker can exploit this by crafting a malicious NTFS image containing a file with a specially crafted name, leading to the disclosure of potentially confidential information from the ntfs-3g process memory.

In NTFS-3G versions prior to 2021.8.22, a stack buffer overflow occurs when correcting differences between the MFT and MFTMirror. This can lead to code execution or privilege escalation when running with setuid-root.

In NTFS-3G versions prior to 2021.8.22, supplying a specially crafted NTFS inode pathname in an NTFS image can cause a heap buffer overflow, resulting in memory disclosure, denial of service, and even code execution.