ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability
ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.
ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.
- Heap-based buffer overflow in Linux Kernel NTFS3 journal
- CVE-2026-72196 rated CVSS 8.8
- Requires prior low-privileged local code execution
- Results in arbitrary code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-72196 | Linux kernel: fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass | 8.4 | <1% |
From the original article
This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.