CVE Feed

    Dashboard / CVE / CVE-2026-46572

    CVE-2026-46572

    In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.

    Published:Oct 7, 2026
    Last Modified:Oct 8, 2026
    EPS:Oct 7, 2026
    EPSS Score:0.00128
    CVSS Score:7.4

    Affected Products

    Vendor
    Tuxera
    Product
    Ntfs-3g

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-46571 (CVSS 5.5) — In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that a…
    CVE-2026-42617 (CVSS 7.1) — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacke…
    CVE-2026-42618 (CVSS 7.1) — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an at…
    CVE-2026-42616 (CVSS 7.8) — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to cor…
    CVE-2026-46569 (CVSS 7.7) — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that …
    CVE-2026-46570 (CVSS 8.1) — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that…
    CVE-2026-56135 (CVSS 7.4) — In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libn…
    CVE-2026-56136 (CVSS 4.7) — In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows…
    CVE-2026-40706 (CVSS 8.4) — In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls…
    CVE-2022-40284 (CVSS 7.8) — A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High