CVE-2026-56136
published 2026-08-24CVE-2026-56136: In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential…
PriorityP422medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.12%
1.8th percentile
In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tuxera | ntfs-3g | < 2026.7.7 | 2026.7.7 |
| ubuntu | ntfs-3g | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
NTFS-3G vulnerabilities
vendor_ubuntu·2026-07-16
CVE-2026-42616 NTFS-3G vulnerabilities
Title: NTFS-3G vulnerabilities
Summary: Several security issues were fixed in NTFS-3G.
It was discovered that NTFS-3G had a heap buffer overflow when reading
certain NTFS images. A local attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-42616)
It was discovered that NTFS-3G had multiple heap buffer overflows when
processing certain NTFS images. A local attacker could possibly use these
issues to execute arbitrary code. (CVE-2026-42617, CVE-2026-42618,
CVE-2026-46569, CVE-2026-46570, CVE-2026-46572, CVE-2026-56135)
It was discovered that NTFS-3G had out-of-bounds reads when processing
certain NTFS images. A local attacker could possibly use these issues to
obtain sensitive information. (CVE-2026-46571, CVE-2026-56136)
Instructions: In general, a standard syste
VulDB
Tuxera Ntfs-3g up to 2026.2.25 libntfs-3g/index.c ntfs_ir_nill out-of-bounds
vuldb·2026-08-24
CVE-2026-56136 [LOW] Tuxera Ntfs-3g up to 2026.2.25 libntfs-3g/index.c ntfs_ir_nill out-of-bounds
A vulnerability categorized as problematic has been discovered in Tuxera Ntfs-3g up to 2026.2.25. Affected is the function ntfs_ir_nill of the file libntfs-3g/index.c. Executing a manipulation can lead to out-of-bounds read.
This vulnerability is tracked as CVE-2026-56136. The attack is restricted to local execution. No exploit exists.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read [fedora-all]
bugzilla·2026-08-24
CVE-2026-56136 [LOW] CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read [fedora-all]
CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.
Bugzilla
CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read [epel-all]
bugzilla·2026-08-24
CVE-2026-56136 [LOW] CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read [epel-all]
CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.
Bugzilla
CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read
bugzilla·2026-08-24
CVE-2026-56136 [LOW] CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read
CVE-2026-56136 ntfs-3g: NTFS-3G: Information disclosure due to out-of-bounds read
In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.
2026-08-24
Published