CVE-2026-40706

{
  "id": "CVE-2026-40706",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T22:16:19.077",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs."
    },
    {
      "lang": "es",
      "value": "En NTFS-3G 2022.10.3 anterior a 2026.2.25, existe un desbordamiento de búfer de montón en ntfs_build_permissions_posix() en acls.c que permite a un atacante corromper la memoria del montón en el binario ntfs-3g SUID-root mediante la creación de una imagen NTFS maliciosa. El desbordamiento se activa en la ruta de LECTURA (stat, readdir, open) al procesar un descriptor de seguridad con múltiples ACEs ACCESS_DENIED que contienen WRITE_OWNER de SIDs de grupo distintos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Tuxera",
          "product": "NTFS-3G",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "2022.10.3",
              "lessThan": "2026.2.25",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T13:03:14.635555Z",
          "id": "CVE-2026-40706",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tuxera/ntfs-3g/blob/d3ace19838ce37cfde55294e76841e6d2f393f9e/libntfs-3g/acls.c#L4011-L4027",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tuxera/ntfs-3g/releases/tag/2026.2.25",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-4cwv-5285-63v9",
      "source": "[email protected]"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2026/04/21/4",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/21/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00024.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}