CVE-2026-56136 in Ntfs-3g
Summary
by MITRE • 08/24/2026
In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified within the NTFS-3G library, specifically affecting versions through 2026.2.25, represents a critical memory safety flaw located in the ntfs_ir_nill function found in libntfs-3g/index.c. This out-of-bounds read condition arises from insufficient validation of input parameters when processing directory index records during file system operations. The core technical failure lies in the logic that calculates buffer boundaries relative to the size and structure of incoming NTFS metadata, allowing an attacker to craft a malicious NTFS image where specific fields are manipulated to cause the function to access memory locations beyond the allocated buffer limits. This type of error is classically categorized under CWE-125, which defines out-of-bounds read vulnerabilities that occur when software reads data from outside the intended bounds of a buffer or array.
The operational impact of this vulnerability is significant because it enables information disclosure without requiring authentication on many systems where NTFS volumes are mounted for interoperability with Windows environments. By crafting a malicious NTFS image containing specially formatted directory entries, an attacker can trigger the out-of-bounds read when a user attempts to create or access a file with the crafted name within that volume. The consequence is the potential leakage of sensitive data residing in adjacent memory spaces of the ntfs-3g process, which may include cryptographic keys, session tokens, passwords, or other confidential information previously loaded into memory by the application. This aligns with ATT&CK technique T1005, Data from Local System, as it facilitates the exfiltration of data directly from the local machine's memory through a file system driver interaction rather than direct network exploitation.
The attack vector is primarily localized to scenarios where users mount untrusted or externally sourced NTFS-formatted storage media, such as USB drives or external hard disks, on Linux-based systems utilizing ntfs-3g for read-write access. The trigger mechanism relies on the creation of a file with a crafted name, which forces the index handling routine to parse malformed directory entry structures. Because ntfs-3g operates in user space rather than kernel space, the impact is generally limited to the privileges of the user running the mount operation or the specific application accessing the volume, though privilege escalation could occur if combined with other vulnerabilities or misconfigurations that allow for arbitrary code execution following memory corruption events.
Mitigation strategies should focus on immediate patching and defensive configuration practices. Users must update their ntfs-3g installations to version 2026.2.25 or later, where the developers have implemented proper bounds checking within the index handling routines to prevent access to invalid memory addresses. In environments where mounting untrusted media is a risk vector, administrators should consider restricting write permissions on NTFS volumes mounted via ntfs-3g, thereby preventing attackers from creating the malicious file structures required to trigger the vulnerability. Additionally, deploying intrusion detection systems that monitor for unusual system calls related to file creation and memory access patterns can provide an additional layer of defense against exploitation attempts targeting this specific flaw in legacy or unpatched systems.