CVE-2026-56136: NTFS-3G Information Disclosure Vulnerability

CVE-2026-56136 Overview

CVE-2026-56136 is an out-of-bounds read vulnerability in NTFS-3G through version 2026.2.25. The flaw resides in the ntfs_ir_nill() function within libntfs-3g/index.c. An attacker who supplies a crafted NTFS image can trigger the read when a file with a specially crafted name is created. The out-of-bounds access may leak potentially confidential information from the ntfs-3g process memory. NTFS-3G is a widely deployed open-source driver used across Linux, macOS, BSD, and embedded systems to read and write Microsoft NTFS volumes.

Critical Impact
A crafted NTFS image can cause the ntfs-3g process to read beyond allocated buffer boundaries, exposing sensitive in-process memory to an attacker who controls filesystem input.

Affected Products

NTFS-3G through 2026.2.25
Tuxera NTFS-3G open-source distribution
Downstream Linux and BSD packages bundling vulnerable libntfs-3g

Discovery Timeline

2026-08-24 - CVE-2026-56136 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-56136

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in ntfs_ir_nill(), a routine in libntfs-3g/index.c responsible for handling index records within NTFS directory structures. When the driver processes a file creation operation involving a crafted name on a malicious NTFS image, ntfs_ir_nill() reads memory outside the intended buffer bounds. The read may return residual heap or stack data belonging to the ntfs-3g process. Because ntfs-3g frequently runs with elevated privileges through FUSE setuid helpers or automatic mount daemons, disclosed memory can include cryptographic material, credentials, or filesystem metadata.

Root Cause

The root cause is missing or insufficient bounds validation on index-record fields before pointer arithmetic and dereference in ntfs_ir_nill(). Attacker-controlled length or offset values from the malicious NTFS image steer the read outside the allocated buffer. The function trusts on-disk metadata without verifying it against the containing index block size.

Attack Vector

Exploitation requires the target host to mount or otherwise process a malicious NTFS image supplied by the attacker. Common delivery paths include removable USB media, disk images downloaded and auto-mounted by desktop environments, or forensic tooling that opens attacker-provided evidence images. Once the volume is mounted, creating a file with a crafted name inside the malicious volume triggers the vulnerable code path. No authentication to the target service is required beyond the ability to introduce the crafted image.

No public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-r66g-c39x-cw95 for authoritative technical details.

Detection Methods for CVE-2026-56136

Indicators of Compromise

Unexpected mounts of NTFS volumes from removable media or user-writable paths performed by ntfs-3g or mount.ntfs-3g.
Crashes or abnormal termination of the ntfs-3g FUSE process shortly after an NTFS image is attached.
Presence of NTFS images with anomalous index-record sizes or malformed $INDEX_ROOT attributes on user-supplied media.

Detection Strategies

Audit process execution logs for invocations of ntfs-3g, mount.ntfs-3g, and ntfsfix with source paths outside trusted storage.
Enable AddressSanitizer or Valgrind memory error detection on test systems that regularly ingest untrusted NTFS images.
Correlate udev and systemd-udevd mount events with subsequent ntfs-3g memory faults or SIGSEGV signals.

Monitoring Recommendations

Forward FUSE and kernel log messages referencing ntfs-3g to a centralized log platform for continuous review.
Alert on any NTFS mount originating from /media, /run/media, or user home directories on servers where such activity is not expected.
Track package versions of ntfs-3g across the fleet and flag hosts running builds at or below 2026.2.25.

How to Mitigate CVE-2026-56136

Immediate Actions Required

Upgrade NTFS-3G to a version later than 2026.2.25 once the maintainer publishes a fixed release referenced in GHSA-r66g-c39x-cw95.
Disable automatic mounting of removable NTFS media on multi-user systems and servers.
Restrict which users can invoke mount.ntfs-3g by removing the setuid bit where operationally acceptable.

Patch Information

Consult the upstream GitHub Security Advisory GHSA-r66g-c39x-cw95 for the fixed version and commit reference. Apply distribution-provided package updates for ntfs-3g and libntfs-3g as they become available from vendors such as Debian, Ubuntu, Red Hat, and SUSE.

Workarounds

Refuse to mount NTFS images from untrusted sources until a patched build is deployed.
Use the read-only kernel ntfs3 driver where feasible, avoiding the userspace ntfs-3g code path.
Sandbox forensic and analysis workflows that process untrusted NTFS images inside disposable virtual machines or containers with no access to sensitive host memory.

bash

# Verify installed ntfs-3g version and remove setuid where not required
ntfs-3g --version
sudo chmod u-s /usr/bin/ntfs-3g /sbin/mount.ntfs-3g 2>/dev/null || true

# Disable automatic NTFS mounting via udisks2 policy (example)
sudo tee /etc/polkit-1/rules.d/10-block-ntfs-automount.rules > /dev/null <<'EOF'
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.udisks2.filesystem-mount" &&
        action.lookup("id.type") == "ntfs") {
        return polkit.Result.AUTH_ADMIN;
    }
});
EOF