CVE-2026-40706
High · 8.4CVSS
8.4
EPSS
0.2%
Published
Apr 21, 2026
CISA due date
—
The record
In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | ntfs-3g_ntfsprogs | 0 | 2022.10.3-6.1 |
Related vulnerabilities
- CVE-2023-52890 NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. Also affects ntfs-3g_ntfsprogs
- CVE-2026-112403 Pillow is a Python imaging library. CWE-122
- CVE-2026-112393 Pillow is a Python imaging library. CWE-122
- CVE-2026-112395 Pillow is a Python imaging library. CWE-122
- CVE-2026-103658 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer… CWE-122
- CVE-2026-107161 A heap-based buffer overflow flaw was found in Cyrus SASL. CWE-122
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-122
- CVE-2026-106564 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-122