Vulnerability Details CVE-2026-56136
In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 2.0%
CVSS Severity
CVSS v3 Score 4.7
Products affected by CVE-2026-56136
-
cpe:2.3:a:tuxera:ntfs-3g:-
-
cpe:2.3:a:tuxera:ntfs-3g:2009.1.1
-
cpe:2.3:a:tuxera:ntfs-3g:2009.11.14
-
cpe:2.3:a:tuxera:ntfs-3g:2009.2.1
-
cpe:2.3:a:tuxera:ntfs-3g:2009.3.8
-
cpe:2.3:a:tuxera:ntfs-3g:2009.4.4
-
cpe:2.3:a:tuxera:ntfs-3g:2010.1.16
-
cpe:2.3:a:tuxera:ntfs-3g:2010.10.2
-
cpe:2.3:a:tuxera:ntfs-3g:2010.3.6
-
cpe:2.3:a:tuxera:ntfs-3g:2010.5.16
-
cpe:2.3:a:tuxera:ntfs-3g:2010.5.22
-
cpe:2.3:a:tuxera:ntfs-3g:2010.8.8
-
cpe:2.3:a:tuxera:ntfs-3g:2011.1.15
-
cpe:2.3:a:tuxera:ntfs-3g:2011.4.12
-
cpe:2.3:a:tuxera:ntfs-3g:2012.1.15
-
cpe:2.3:a:tuxera:ntfs-3g:2013.1.13
-
cpe:2.3:a:tuxera:ntfs-3g:2014.2.15
-
cpe:2.3:a:tuxera:ntfs-3g:2015.3.14
-
cpe:2.3:a:tuxera:ntfs-3g:2016.2.22
-
cpe:2.3:a:tuxera:ntfs-3g:2017.3.23
-
cpe:2.3:a:tuxera:ntfs-3g:2021.8.22
-
cpe:2.3:a:tuxera:ntfs-3g:2022.10.3
-
cpe:2.3:a:tuxera:ntfs-3g:2022.5.17