CVE Feed

    Dashboard / CVE / CVE-2026-40706

    CVE-2026-40706

    In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.

    Published:Apr 21, 2026
    Last Modified:Apr 22, 2026
    EPS:Apr 21, 2026
    EPSS Score:0.00013
    CVSS Score:8.4

    Affected Products

    Vendor
    Tuxera
    Product
    Ntfs-3g

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-122 Heap-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-56136 (CVSS 4.7) — In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows…
    CVE-2026-56135 (CVSS 7.4) — In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libn…
    CVE-2022-40284 (CVSS 7.8) — A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code…
    CVE-2022-30785 (CVSS 6.7) — A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read a…
    CVE-2022-30787 (CVSS 6.7) — An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22…
    CVE-2022-30789 (CVSS 7.8) — A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through …
    CVE-2022-30786 (CVSS 7.8) — A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021…
    CVE-2022-30788 (CVSS 7.8) — A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22…
    CVE-2022-30784 (CVSS 7.8) — A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.…
    CVE-2022-30783 (CVSS 6.7) — An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High