CVE-2026-40706: NTFS-3G Buffer Overflow Vulnerability

CVE-2026-40706 Overview

CVE-2026-40706 is a heap buffer overflow vulnerability affecting NTFS-3G versions prior to 2026.2.25. The flaw exists in the ntfs_build_permissions_posix() function within acls.c, allowing an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. Because the NTFS-3G binary typically runs with elevated privileges to mount filesystems, successful exploitation could lead to local privilege escalation or arbitrary code execution.

Critical Impact

A maliciously crafted NTFS image can trigger heap corruption in the SUID-root ntfs-3g binary, potentially enabling local privilege escalation to root on affected Linux systems.

Affected Products

• NTFS-3G versions 2022.10.3 through versions prior to 2026.2.25
• Linux distributions shipping vulnerable NTFS-3G packages
• Systems using NTFS-3G for NTFS filesystem mounting

Discovery Timeline

• 2026-04-21 - CVE-2026-40706 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40706

Vulnerability Analysis

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The heap buffer overflow is triggered during READ path operations—specifically when processing stat, readdir, or open system calls on files within a mounted NTFS image. The overflow occurs when the ntfs_build_permissions_posix() function parses security descriptors containing multiple ACCESS_DENIED Access Control Entries (ACEs) with WRITE_OWNER permissions from distinct group Security Identifiers (SIDs).

The NTFS-3G driver's ACL processing logic fails to properly validate the number of ACEs when building POSIX permissions, leading to writes beyond the allocated heap buffer boundary. Since NTFS-3G is commonly installed as a SUID-root binary to allow unprivileged users to mount NTFS filesystems, the heap corruption occurs in a privileged context.

Root Cause

The root cause lies in insufficient bounds checking within the ntfs_build_permissions_posix() function in libntfs-3g/acls.c. When processing security descriptors from NTFS images, the function allocates a fixed-size buffer for permission data but does not properly validate that the number of ACCESS_DENIED ACEs with WRITE_OWNER permissions fits within this buffer. A malformed NTFS image can contain an excessive number of these specific ACE entries, causing the function to overflow the allocated heap memory.

The vulnerable code section can be reviewed in the NTFS-3G acls.c source code.

Attack Vector

The attack vector is local, requiring the attacker to present a malicious NTFS image to the target system. This vulnerability requires no privileges and no user interaction to trigger once the malicious image is mounted or accessed.

Exploitation scenarios include:

1. Removable Media Attack: An attacker provides a USB drive or external storage device containing a crafted NTFS filesystem to a target user
2. Downloaded Image Attack: A user downloads and mounts an NTFS disk image (e.g., VM disk, backup image) containing the malicious payload
3. Network Share Attack: A malicious NTFS image shared over a network is mounted by the victim system

The heap corruption occurs during normal file operations (stat, readdir, open) on the malicious filesystem, meaning simply browsing the mounted filesystem contents could trigger the vulnerability.

Detection Methods for CVE-2026-40706

Indicators of Compromise

• Unexpected crashes or segmentation faults in the ntfs-3g process during NTFS filesystem operations
• Unusual memory allocation patterns or heap corruption errors in system logs related to NTFS mounts
• Suspicious NTFS images with abnormally large or malformed security descriptors
• Core dumps from ntfs-3g indicating heap-related failures in ACL processing functions

Detection Strategies

• Monitor for ntfs-3g process crashes, particularly those involving signals like SIGSEGV or SIGABRT during mount or file access operations
• Implement file integrity monitoring to detect unexpected changes to NTFS-3G binaries or libraries
• Use memory debugging tools (AddressSanitizer, Valgrind) in development environments to detect heap overflows during NTFS image processing
• Deploy endpoint detection solutions capable of monitoring privileged process anomalies

Monitoring Recommendations

• Enable core dump collection for ntfs-3g processes to capture forensic data from exploitation attempts
• Monitor system logs for repeated mount failures or filesystem errors associated with NTFS volumes
• Track the provenance of removable media and disk images before allowing them to be mounted on sensitive systems

How to Mitigate CVE-2026-40706

Immediate Actions Required

• Update NTFS-3G to version 2026.2.25 or later immediately
• Restrict NTFS-3G usage to trusted administrators until patches are applied
• Avoid mounting untrusted NTFS images or media from unknown sources
• Consider removing the SUID bit from ntfs-3g if root-level mounting by unprivileged users is not required

Patch Information

The NTFS-3G maintainers have released version 2026.2.25 which addresses this vulnerability. The patch adds proper bounds checking to the ntfs_build_permissions_posix() function to prevent heap buffer overflow when processing malformed security descriptors.

Relevant security resources:

• NTFS-3G Release 2026.2.25
• GitHub Security Advisory GHSA-4cwv-5285-63v9
• Debian LTS Security Announcement
• Openwall OSS-Security Discussion

Workarounds

• Remove the SUID bit from the ntfs-3g binary to prevent privilege escalation (requires root for mounting)
• Use kernel-native NTFS support (ntfs3 driver in Linux 5.15+) as an alternative to NTFS-3G
• Implement strict access controls limiting which users can mount external media
• Mount NTFS filesystems in isolated environments or containers when handling untrusted images

To remove the SUID bit from ntfs-3g as a temporary mitigation, administrators can use the following command:

# Remove SUID bit from ntfs-3g binary (requires root privileges)
# Note: This will require root to mount NTFS filesystems
chmod u-s /usr/bin/ntfs-3g
chmod u-s /bin/ntfs-3g

# Verify the change
ls -la /usr/bin/ntfs-3g