Summary
Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8
sequences. An attacker could use this issue to cause NTFS-3G to crash,
resulting in a denial of service, or to execute arbitrary code. This issue
only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-52890)
Andrea Bocchetti discovered that NTFS-3G incorrectly handled certain
security descriptors. An attacker could use this issue to cause NTFS-3G to
crash, resulting in a denial of service, or to execute arbitrary code.
(CVE-2026-40706)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | ntfs-3g | 1:2021.8.22-3ubuntu1.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | ntfs-3g | 1:2022.10.3-1.2ubuntu3.1 |
| Ubuntu · 25.10 | ntfs-3g | 1:2022.10.3-5ubuntu0.25.10.1 |
Vulnerabilities 2
-
High 8.4
In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that a…
-
Medium 4.5
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests tha…