The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21484-1 advisory.

    - CVE-2026-42616: heap buffer overflow in `cat()` of `cat.c` can lead to heap corruption in the ntfscat     binary via a       specially crafted NTFS image (bsc#1271102).
    - CVE-2026-42617: heap buffer overflow in `ntfs_ir_to_ib()` of `index.c` can lead to heap corruption in     the SUID-root       ntfs-3g binary via a specially crafted NTFS image (bsc#1271103).
    - CVE-2026-42618: heap buffer overflow in `ntfs_decompress()` of `compress.c` can lead to heap corruption     in the       SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271104).
    - CVE-2026-46569: heap buffer overflow in `ntfs_ib_copy_tail()` of `libntfs-3g/index.c`can lead to heap     corruption in       the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271105).
    - CVE-2026-46570: heap buffer overflow in `ntfs_index_walk_down()` of `libntfs-3g/index.c` can lead to     heap corruption       in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271106).
    - CVE-2026-46571: out-of-bounds read in `ntfs_fix_file_name()` of `libntfs-3g/reparse.c` can lead to     disclosure of       confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image     (bsc#1271107).
    - CVE-2026-46572: heap buffer overflow in `ntfs_ib_cut_tail()` of `libntfs-3g/index.c` can lead to heap     corruption       in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271108).
    - CVE-2026-56135: heap-based buffer overflow in `build_inherited_id()` of `libntfs-3g/security.c` can lead     to heap       corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271109).
    - CVE-2026-56136: out-of-bounds read in `ntfs_ir_nill()` of `libntfs-3g/index.c` can lead to disclosure of       confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image     (bsc#1271110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6389 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6389-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 15, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ntfs-3g     CVE ID         : CVE-2026-42616 CVE-2026-42617 CVE-2026-42618 CVE-2026-46569                      CVE-2026-46570 CVE-2026-46571 CVE-2026-46572 CVE-2026-56135                      CVE-2026-56136     Debian Bug     : 1142144

    Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS     driver for FUSE. A local user can take advantage of these flaws for     local root privilege escalation.

    For the stable distribution (trixie), these problems have been fixed in     version 1:2022.10.3-5+deb13u2.

    We recommend that you upgrade your ntfs-3g packages.

    For the detailed security status of ntfs-3g please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/ntfs-3g

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099504 advisory.

    Unity Link Advisory UTSA-2026-099504

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3214-1 advisory.

    This update for ntfs-3g_ntfsprogs fixes the following issues

    - CVE-2026-42616: heap buffer overflow in `cat()` of `cat.c` can lead to heap corruption in the ntfscat     binary via a       specially crafted NTFS image (bsc#1271102).
    - CVE-2026-42617: heap buffer overflow in `ntfs_ir_to_ib()` of `index.c` can lead to heap corruption in     the SUID-root       ntfs-3g binary via a specially crafted NTFS image (bsc#1271103).
    - CVE-2026-42618: heap buffer overflow in `ntfs_decompress()` of `compress.c` can lead to heap corruption     in the       SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271104).
    - CVE-2026-46569: heap buffer overflow in `ntfs_ib_copy_tail()` of `libntfs-3g/index.c`can lead to heap     corruption in       the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271105).
    - CVE-2026-46570: heap buffer overflow in `ntfs_index_walk_down()` of `libntfs-3g/index.c` can lead to     heap corruption       in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271106).
    - CVE-2026-46571: out-of-bounds read in `ntfs_fix_file_name()` of `libntfs-3g/reparse.c` can lead to     disclosure of       confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image     (bsc#1271107).
    - CVE-2026-46572: heap buffer overflow in `ntfs_ib_cut_tail()` of `libntfs-3g/index.c` can lead to heap     corruption       in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271108).
    - CVE-2026-56135: heap-based buffer overflow in `build_inherited_id()` of `libntfs-3g/security.c` can lead     to heap       corruption in the SUID-root ntfs-3g binary via a specially crafted NTFS image (bsc#1271109).
    - CVE-2026-56136: out-of-bounds read in `ntfs_ir_nill()` of `libntfs-3g/index.c` can lead to disclosure of       confidential information from the ntfs-3g process memory when handling a specially crafted NTFS image     (bsc#1271110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3213-1 advisory.

    This update for ntfs-3g_ntfsprogs fixes the following issues

    - CVE-2026-42616: heap buffer overflow in cat() in cat.c (bsc#1271102).
    - CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib() in index.c (bsc#1271103).
    - CVE-2026-42618: heap buffer overflow in ntfs_decompress() in compress.c (bsc#1271104).
    - CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail() in libntfs-3g/index.c (bsc#1271105).
    - CVE-2026-46570: heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c     (bsc#1271106).
    - CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name() in libntfs-3g/reparse.c (bsc#1271107).
    - CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail() in libntfs-3g/index.c (bsc#1271108).
    - CVE-2026-56135: heap-based buffer overflow in build_inherited_id() in libntfs-3g/security.c     (bsc#1271109).
    - CVE-2026-56136: out-of-bounds read in ntfs_ir_nill() in libntfs-3g/index.c (bsc#1271110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202608-13 (NTFS-3G: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in NTFS-3G. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8554-1 advisory.

    It was discovered that NTFS-3G had a heap buffer overflow when reading certain NTFS images. A local     attacker could possibly use this issue to execute arbitrary code. (CVE-2026-42616)

    It was discovered that NTFS-3G had multiple heap buffer overflows when processing certain NTFS images. A     local attacker could possibly use these issues to execute arbitrary code. (CVE-2026-42617, CVE-2026-42618,     CVE-2026-46569, CVE-2026-46570, CVE-2026-46572, CVE-2026-56135)

    It was discovered that NTFS-3G had out-of-bounds reads when processing certain NTFS images. A local     attacker could possibly use these issues to obtain sensitive information. (CVE-2026-46571, CVE-2026-56136)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that     allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious     NTFS image. This read operation is triggered by creation of a file with a crafted name. (CVE-2026-56136)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
331555	openSUSE 16: libntfs-3g-devel / libntfs-3g89 / ntfs-3g / ntfsprogs / etc (openSUSE-SU-2026:21484-1)	Nessus	SuSE Local Security Checks	8/1/2026	8/31/2026	high
327201	Debian dsa-6389 : libntfs-3g89t64 - security update	Nessus	Debian Local Security Checks	7/16/2026	7/16/2026	high
336423	Unity Linux 20.1070e Security Update: ntfs-3g (UTSA-2026-099504)	Nessus	Unity Linux Local Security Checks	8/17/2026	8/31/2026	medium
329281	SUSE SLED15 / SLES15 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2026:3214-1)	Nessus	SuSE Local Security Checks	7/24/2026	8/31/2026	high
329286	SUSE SLES12 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2026:3213-1)	Nessus	SuSE Local Security Checks	7/24/2026	8/31/2026	high
335895	GLSA-202608-13 : NTFS-3G: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/16/2026	8/16/2026	high
327650	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : NTFS-3G vulnerabilities (USN-8554-1)	Nessus	Ubuntu Local Security Checks	7/17/2026	7/17/2026	high
327189	Linux Distros Unpatched Vulnerability : CVE-2026-56136	Nessus	Misc.	7/16/2026	9/2/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

high

medium