CVE Feed

    Dashboard / CVE / CVE-2026-56136

    CVE-2026-56136

    In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.

    Published:Aug 24, 2026
    Last Modified:Aug 28, 2026
    EPS:Aug 24, 2026
    EPSS Score:0.00141
    CVSS Score:4.7

    Affected Products

    Vendor
    Tuxera
    Product
    Ntfs-3g

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-56135 (CVSS 7.4) — In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libn…
    CVE-2026-40706 (CVSS 8.4) — In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls…
    CVE-2022-40284 (CVSS 7.8) — A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code…
    CVE-2022-30785 (CVSS 6.7) — A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read a…
    CVE-2022-30787 (CVSS 6.7) — An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22…
    CVE-2022-30789 (CVSS 7.8) — A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through …
    CVE-2022-30786 (CVSS 7.8) — A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021…
    CVE-2022-30788 (CVSS 7.8) — A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22…
    CVE-2022-30784 (CVSS 7.8) — A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.…
    CVE-2022-30783 (CVSS 6.7) — An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High