CVE-2026-56135

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in NTFS-3G

Publication date: 2026-08-24

Last updated on: 2026-09-09

Assigner: MITRE

Description

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-09-09

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-13

NVD

CVE-2026-56135

EUVD

EUVD-2026-65147

Affected Vendors & Products

Vendor	Product	Version / Range
ntfs-3g	ntfs-3g	to 2026.2.25 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based buffer overflow in NTFS-3G through 2026.2.25. It exists in the function build_inherited_id() located in libntfs-3g/security.c. An attacker can exploit this by creating a malicious NTFS image and placing a file in a specially crafted directory. This causes heap memory corruption in the SUID-root ntfs-3g binary, potentially leading to arbitrary code execution.

Detection Guidance

This vulnerability can be detected by checking the version of NTFS-3G installed on your system. Run 'ntfs-3g --version' or 'dpkg -l ntfs-3g' on Debian-based systems to verify if the vulnerable version (through 2026.2.25) is present.

Impact Analysis

If you use NTFS-3G on a system where the binary has SUID-root privileges, an attacker could exploit this vulnerability to gain root access. This could allow them to execute arbitrary commands, install malware, or steal sensitive data. Systems using vulnerable versions of NTFS-3G are at risk if they process untrusted NTFS images.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA if the affected NTFS-3G system is used in environments subject to these regulations. A heap-based buffer overflow in a SUID-root binary may allow privilege escalation or arbitrary code execution, which could lead to unauthorized access to sensitive data. Such breaches could violate GDPR's data protection requirements or HIPAA's security rules for protected health information.

Mitigation Strategies

Immediately update NTFS-3G to the latest version beyond 2026.2.25. If updating is not possible, consider disabling the SUID bit on the ntfs-3g binary with 'chmod u-s /path/to/ntfs-3g' as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-56135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70