CVE-2026-56135: NTFS-3G Heap Buffer Overflow Vulnerability

CVE-2026-56135 Overview

CVE-2026-56135 is a heap-based buffer overflow in NTFS-3G through version 2026.2.25. The flaw resides in the build_inherited_id() function within libntfs-3g/security.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by supplying a crafted NTFS image. Triggering the overflow requires creating a file inside a maliciously prepared directory on the mounted image. Because ntfs-3g typically runs with SUID-root privileges, successful exploitation can escalate privileges on affected Linux systems.

Critical Impact
Heap corruption in a SUID-root binary can enable local privilege escalation to root through a crafted NTFS filesystem image.

Affected Products

NTFS-3G through 2026.2.25
Linux distributions bundling vulnerable NTFS-3G packages
Systems where ntfs-3g is installed with the SUID-root bit set

Discovery Timeline

2026-08-24 - CVE-2026-56135 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-56135

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow located in build_inherited_id() inside libntfs-3g/security.c. This function constructs inherited security identifiers when new files or directories are created on an NTFS volume. When the parent directory's security descriptor is attacker-controlled through a crafted NTFS image, the function miscalculates or fails to validate the size of the destination heap buffer. Writing the inherited identifier data past the allocated region corrupts adjacent heap metadata and objects. The ntfs-3g binary generally executes with SUID-root privileges to support user-mounted volumes, so heap corruption occurs in a privileged context.

Root Cause

The root cause is improper bounds enforcement when copying inherited security identifier data derived from parent directory attributes on disk. NTFS-3G trusts sizes and offsets present in the on-disk structures without sufficient validation, allowing an attacker to shape a heap write that exceeds the allocated buffer.

Attack Vector

Exploitation requires an attacker to supply a malicious NTFS image and induce a file creation inside a crafted directory on that image. This can occur when a user mounts an attacker-supplied image, such as a USB drive or a disk file, using the SUID-root ntfs-3g binary. Once the crafted directory is accessed and a file is created within it, build_inherited_id() processes the malicious security descriptor and corrupts the heap. Successful exploitation targets privileged memory to achieve local privilege escalation. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-56135

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in the ntfs-3g process, particularly during file creation on mounted NTFS volumes
Mount operations against NTFS images originating from removable media or user home directories followed by privilege changes
Presence of ntfs-3g core dumps referencing build_inherited_id or libntfs-3g/security.c in stack traces

Detection Strategies

Audit installed NTFS-3G package versions across Linux endpoints and flag any at or below 2026.2.25
Monitor execve telemetry for invocations of ntfs-3g or mount.ntfs-3g with the SUID bit set
Correlate NTFS mount events with subsequent process creations running as UID 0 that were spawned by non-root users

Monitoring Recommendations

Enable Linux auditd rules for mount syscalls and executions of /bin/ntfs-3g and /sbin/mount.ntfs-3g
Alert on removable-media insertion events followed by NTFS mount attempts on multi-user systems
Capture and retain core dumps from ntfs-3g to support post-incident analysis of heap corruption

How to Mitigate CVE-2026-56135

Immediate Actions Required

Update NTFS-3G to a fixed version above 2026.2.25 once released by the distribution vendor
Remove the SUID bit from the ntfs-3g binary on systems where user-mounted NTFS volumes are not required
Restrict which users can mount removable media, especially on shared or multi-user hosts

Patch Information

Refer to the upstream project advisory at Tuxera NTFS-3G Security Advisory GHSA-c9qg-fh4v-mq8r for patch commits and fixed version information. Apply distribution-provided security updates for the ntfs-3g package as soon as they become available.

Workarounds

Disable automatic mounting of NTFS volumes from removable devices through desktop policy
Strip the SUID bit using chmod u-s /bin/ntfs-3g where privileged user mounts are not needed
Restrict access to ntfs-3g to trusted administrators via filesystem permissions or Polkit rules

bash

# Configuration example
# Remove SUID from ntfs-3g to prevent privileged exploitation
sudo chmod u-s /bin/ntfs-3g

# Verify the SUID bit has been removed
ls -l /bin/ntfs-3g

# Update the package on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get install --only-upgrade ntfs-3g