https://seclists.org/oss-sec/2026/q2/193: CVE-2026-40706: ntfs-3g 2022.10.3: Heap buffer overflow
Published Apr 21, 2026
·Updated
Affected Software
1 affected component
tuxera NTFS-3G=2022.10.3
Frequently Asked Questions
1
Does exploitation require remote access or user interaction?
The CVSS vector indicates local access is required and no user interaction is needed. It also indicates that the attacker must already have low-level privileges.
2
Which version contains the fix?
The advisory identifies the 2026.2.25 release as the fixed version. Version 2022.10.3 is specifically identified in the report.
3
What is the expected impact of successful exploitation?
The CVSS vector rates confidentiality, integrity, and availability impact as high. The overall CVSS 3.1 score is 7.8 (High).
4
Is a temporary mitigation documented if upgrading is not immediately possible?
No temporary mitigation or configuration workaround is provided in the available advisory data. The documented remediation is to use the fixed release.