Vulnerabilities
Linux Kernel NTFS3 Out‑Of‑Bounds Read Vulnerability (ZDI‑26‑697) – Patch Required
A local attacker with low‑privilege code execution can read beyond array bounds in the NTFS3 driver, exposing sensitive data and potentially enabling kernel‑level code execution. Linux kernel maintainers have released a patch; administrators should update immediately and monitor for exploitation attempts.
On September 14 2026, the Zero Day Initiative disclosed an out‑of‑bounds read in the Linux kernel’s NTFS3 driver. The flaw resides in extended‑attribute handling and can be triggered by a local attacker who already has low‑privilege code execution.
What Happened
When processing user‑supplied extended attributes, the kernel fails to validate bounds, allowing a read past the end of an allocated array. The resulting information disclosure can leak kernel memory contents.
Impact
- High‑severity information disclosure (CVSS 7.3).
- Potential for chaining with other local exploits to achieve kernel‑level code execution.
- Affected systems: any Linux installation using the default NTFS3 driver (kernel 5.x and newer).
What to Do
- Apply the latest kernel patch as soon as possible.
- Verify kernel version with uname -r and compare against the patched release.
- Restrict local code execution by enforcing least‑privilege policies and SELinux/AppArmor profiles.
- Monitor system logs for anomalous read or extended‑attribute operations.
Additional Notes
CVSS: 7.3 – Attack Vector: Local, Privileges Required: Low, User Interaction: None, Scope: Changed, Confidentiality: High, Integrity: None, Availability: Low.
Related vulnerabilities
Linux Kernel TLS Protocol Out-of-Bounds Read Vulnerability (CVE-2026-64046)
A high-privileged local attacker can exploit an out-of-bounds read vulnerability in the Linux kernel TLS protocol implementation to disclose sensitive memory. Tracked as CVE-2026-64046 with a CVSS score of 6.7, the flaw stems from inadequate input validation during message splicing. System administrators must apply the official kernel patch to remediate the issue.
Read briefing
Windows Overlay Filter RCE Vulnerability (CVE‑2026‑69959) – Immediate Patch Required
Microsoft has disclosed a high‑severity out‑of‑bounds read in the Windows Overlay Filter that allows an authorized user to execute arbitrary code locally. The flaw is fixed in the latest security update; administrators must apply the patch and verify system integrity.
Read briefing
CVE-2026-108466: Windows Kernel Out-of-Bounds Read Causes Network Denial of Service
An out-of-bounds read in the Windows kernel (CVE-2026-108466) can be exploited by an unauthorized network attacker to trigger a denial of service. Microsoft has released a patch; administrators should update affected systems and monitor for abnormal traffic.
Read briefing
CVE-2026-70063: Local Windows Kernel Information Disclosure Vulnerability
Microsoft has identified CVE-2026-70063, an out‑of‑bounds read in the Windows kernel that permits a local, authorized attacker to read sensitive memory. The flaw is fixed in the latest cumulative update for Windows 10, Windows 11, and Windows Server 2022. Defenders should verify that the update is installed and monitor for any anomalous local privilege activity.
Read briefing