{"id":"CVE-2026-46072","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-46072","generatedAt":"2026-10-28T04:16:58.838Z","title":"In the Linux kernel, the following vulnerability has been resolved: ntfs3: add buffer boundary checks to run_unpack() run_unpack() checks `run_buf < run_last` at the top of the while loop but then reads size_size and offset_size bytes via…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: add buffer boundary checks to run_unpack()\n\nrun_unpack() checks `run_buf < run_last` at the top of the while loop\nbut then reads size_size and offset_size bytes via run_unpack_s64()\nwithout verifying they fit within the remaining buffer.  A crafted NTFS\nimage with truncated run data in an MFT attribute triggers an OOB heap\nread of up to 15 bytes when the filesystem is mounted.\n\nAdd boundary checks before each run_unpack_s64() call to ensure the\ndeclared field size does not exceed the remaining buffer.\n\nFound by fuzzing with a source-patched harness (LibAFL + QEMU).","published":"2026-05-27T14:17:29.000Z","lastModified":"2026-06-24T16:59:40.000Z","status":"Undergoing Analysis","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"cwe":[],"affected":["linux/linux kernel"],"epss":{"score":0.00123,"percentile":0.02027,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.12%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/41aadf5cb482793a24e05aa136224e179a778586","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/425de2aba0d061b3e715d51a3b1992c112ed5b99","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b62567bca47408e6739dee75f02a2113548af875","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbad75336870b51b81979b97613746237fcb02fe","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3012690a7065d9ca86521a525ad11e8af491d45","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e64f7dfcaff79e7dfff9121a382dd77f9b462f62","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-46072","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}