CVE-2026-56135 in ntfs-3g
Summary
by MITRE • 08/24/2026
In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in NTFS-3G versions through 2026.2.25 represents a critical security flaw within the core library responsible for handling New Technology File System structures on non-Windows operating systems. Specifically, this heap-based buffer overflow resides in the build_inherited_id function located within the libntfs-3g/security.c source file. This component is integral to processing Access Control Lists and security descriptors associated with files and directories stored on NTFS volumes. The root cause of the vulnerability stems from insufficient validation of input data derived from maliciously crafted NTFS images, allowing an attacker to manipulate internal buffer boundaries during the construction of inherited identity identifiers.
When a user or automated process mounts a compromised NTFS image containing specially constructed directory structures, the library attempts to parse and reconstruct security descriptors for files within those directories. The build_inherited_id function fails to correctly calculate or verify the size of data being copied into heap-allocated memory buffers. By creating a file inside a crafted directory structure embedded in the malicious disk image, an attacker can trigger this overflow condition. As the function processes the malformed input, it writes more data than the allocated buffer can hold, resulting in adjacent heap memory corruption. This type of out-of-bounds write operation disrupts the integrity of heap metadata and potentially overwrites critical control structures or pointers within the application's memory space.
The operational impact of this vulnerability is severe due to the typical execution context of ntfs-3g binaries. These utilities are frequently invoked with root privileges, particularly when mounting filesystems that require administrative access for proper permission handling. Consequently, a successful exploitation allows an attacker to achieve arbitrary code execution by leveraging the heap corruption to hijack control flow within the SUID-root binary. This effectively grants the attacker full system compromise equivalent to root-level access on the affected host. The attack vector is primarily local or remote depending on whether the malicious NTFS image can be introduced into the target environment, such as via removable media or network-mounted shares if supported by the configuration.
From a classification perspective, this vulnerability aligns with CWE-122, which denotes heap-based buffer overflow, and falls under ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques when considering post-exploitation capabilities enabled by code execution. The flaw highlights the risks associated with parsing complex file system structures without rigorous bounds checking, a common pitfall in low-level storage drivers and filesystem implementations.
Mitigation strategies should prioritize immediate patching to version 2026.2.25 or later where this issue has been addressed through improved input validation and buffer size verification within the build_inherited_id function. Organizations relying on NTFS-3G for cross-platform file system access must ensure that their deployment pipelines include automated vulnerability scanning tools capable of detecting outdated library versions. Additionally, implementing strict privilege separation principles can reduce risk; where possible, mounting operations should be delegated to unprivileged helper processes rather than running the entire utility with elevated privileges. For environments requiring high assurance, restricting the ability to mount arbitrary NTFS images from untrusted sources serves as an effective administrative control to prevent exploitation of this specific attack vector.