CVE-2026-40706 Memory corruption in NTFS-3G

High 8.4 Published 21 Apr 2026 Updated 22 Apr 2026

Heap buffer overflow in NTFS-3G allows attackers to execute arbitrary code with root privileges via a malicious NTFS image.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-40706?

CVE-2026-40706 is a high-severity memory corruption vulnerability in Tuxera NTFS-3G, published on 21 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.

Weakness: CWE-122

Which versions are affected by CVE-2026-40706?

Linux distribution packages (5)

`ntfs-3g_ntfsprogs` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`2022.5.17-150000.3.24.1`
`ntfs-3g_ntfsprogs` SUSE:Linux Enterprise Module for Development Tools 15 SP7	All versions	`2022.5.17-150000.3.24.1`
`ntfs-3g_ntfsprogs` SUSE:Linux Enterprise Server 15 SP6-LTSS	All versions	`2022.5.17-150000.3.24.1`
`ntfs-3g_ntfsprogs` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	All versions	`2022.5.17-150000.3.24.1`
`ntfs-3g_ntfsprogs` openSUSE:Tumbleweed	All versions	`2022.10.3-6.1`

How do I fix CVE-2026-40706?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-40706 being exploited?

There is no known exploitation of CVE-2026-40706 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-40706, AZL-83181, DEBIAN-CVE-2026-40706, GHSA-4cwv-5285-63v9, MGASA-2026-0118, OESA-2026-2100 and 10 more.