https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:12:18 +0000 https://vulnerability.circl.lu/vuln/cve-2026-40706 <p><strong>Affected:</strong> Tuxera NTFS-3G</p> <p>In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.</p> <p><strong>Affected:</strong> Tuxera NTFS-3G</p> <p>In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.</p> https://vulnerability.circl.lu/vuln/cve-2026-40706 https://vulnerability.circl.lu/vuln/usn-8192-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ntfs-3g, Ubuntu:24.04:LTS: ntfs-3g, Ubuntu:25.10: ntfs-3g</p> <p>Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8 sequences. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-52890)</p> <p>Andrea Bocchetti discovered that NTFS-3G incorrectly handled certain security descriptors. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. (CVE-2026-40706)</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ntfs-3g, Ubuntu:24.04:LTS: ntfs-3g, Ubuntu:25.10: ntfs-3g</p> <p>Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8 sequences. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-52890)</p> <p>Andrea Bocchetti discovered that NTFS-3G incorrectly handled certain security descriptors. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. (CVE-2026-40706)</p> https://vulnerability.circl.lu/vuln/usn-8192-1