UBUNTU-CVE-2026-56135

MEDIUM5.5

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g

Published Jul 15, 2026

Modified 5 days ago

Fix available

Details

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Affected Packages

ntfs-3g

Ubuntu 18.04 LTS

Affected versions:

1:2016.2.22AR.2-21:2017.3.23-21:2017.3.23-2ubuntu0.18.04.11:2017.3.23-2ubuntu0.18.04.21:2017.3.23-2ubuntu0.18.04.31:2017.3.23-2ubuntu0.18.04.41:2017.3.23-2ubuntu0.18.04.5

ntfs-3g

Ubuntu 20.04 LTS

Affected versions:

1:2017.3.23AR.3-3ubuntu11:2017.3.23AR.3-3ubuntu1.11:2017.3.23AR.3-3ubuntu1.21:2017.3.23AR.3-3ubuntu1.3

ntfs-3g

Ubuntu 22.04 LTS

Fixed in:

1:2021.8.22-3ubuntu1.4

ntfs-3g

Ubuntu 24.04 LTS

Fixed in:

1:2022.10.3-1.2ubuntu3.2

ntfs-3g

Ubuntu 26.04 LTS

Fixed in:

1:2022.10.3-5ubuntu1.1

ntfs-3g

Ubuntu Pro 16.04 LTS

Affected versions:

1:2014.2.15AR.3-31:2015.3.14AR.1-11:2015.3.14AR.1-1build11:2015.3.14AR.1-1ubuntu0.11:2015.3.14AR.1-1ubuntu0.21:2015.3.14AR.1-1ubuntu0.31:2015.3.14AR.1-1ubuntu0.3+esm11:2015.3.14AR.1-1ubuntu0.3+esm21:2015.3.14AR.1-1ubuntu0.3+esm31:2015.3.14AR.1-1ubuntu0.3+esm4

References

REPORT

https://ubuntu.com/security/CVE-2026-56135

ADVISORY

https://ubuntu.com/security/notices/USN-8554-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-56135

Upstream

CVE-2026-56135

USN-8554-1

Ecosystems(6)

Ubuntu 18.04 LTS Ubuntu 20.04 LTS Ubuntu 22.04 LTS Ubuntu 24.04 LTS Ubuntu 26.04 LTS

Timeline

PublishedJul 15, 2026

ModifiedJul 16, 2026

UBUNTU-CVE-2026-56135 | Mondoo Vulnerability Intelligence