CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56136.json"
}

References

Affected packages

Git / github.com/tuxera/ntfs-3g

Affected ranges

Type

GIT

Repo

https://github.com/tuxera/ntfs-3g

Events

Introduced

Fixed

d1cb9e825d059ef5db0ccd30d5bce202edbd69dc

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "NTFS-3G"
        },
        {
            "fixed": "2026.2.25"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

Other

2011_3_26

N0_20061031_BETA

N0_20061115_BETA

N0_20061212_BETA

N0_20061218_BETA

N0_20070102_BETA

N0_20070116_BETA

N0_20070118_BETA

N0_20070207_RC1

N1_0

N1_320_RC

N1_328

N1_411_RC

N1_416

N1_417

N1_516

N1_612_RC

N1_616

N1_710

N1_810

N1_826

N1_910_RC

N1_913

N2006_11_07_011225

N2006_11_08_220332

N2006_11_08_233131

N2006_11_11_005720

N2006_11_11_010308

N2006_11_11_013125

N2006_11_11_220751

N2006_11_14_010037

N2006_11_14_220946

N2009_10_03_095644

N2009_10_03_104125

N2010_10_2

N2010_2_6

N2010_5_16

N2010_5_22

N2010_6_30_RC

N2010_6_31_RC

N2010_7_23_RC

N2010_8_8

PERMISSION_HANDLING_BASE_20070925

R2009_10_5_RC

start

v2011_10_9_RC

v2011_3_26

v2011_3_28_RC

v2011_4_10

v2011_4_11

v2011_4_12

v2012_1_15

v2013_1_13

2014.*

2014.2.15

2015.*

2015.3.13

2015.3.14

2015.3.5

2016.*

2016.2.15

2016.2.22

2017.*

2017.2.15

2017.3.23

2021.*

2021.5.19

2021.8.14

2021.8.22

2022.*

2022.10.3

2022.5.17

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56136.json"