CVE-2026-72191: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-rw89-wm92-gvrj
Share
CVSS 9.8
Published
Advisory Summary

CVE-2026-72191 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72191 at a Glance

CVE Identifier CVE-2026-72191
GHSA Identifier GHSA-rw89-wm92-gvrj
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-72191

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72191, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indx_insert_into_buffer indx_insert_into_buffer() computes used = used1 - to_copy - sp_size; memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off)); where sp and sp_size come from hdr_find_split(). hdr_find_split() walks entries by le16_to_cpu(e->size) without validating that each step stays within hdr->used or that the size field is at least sizeof(struct NTFS_DE). index_hdr_check(), the on-load gatekeeper, only validates header-level fields (used, total, de_off) and does not walk per-entry sizes. A crafted NTFS image whose leaf INDEX_HDR reports used == total but contains one interior NTFS_DE with size = 0xFFF0 therefore passes validation, descends to indx_insert_into_buffer() through the ntfs_create() -> indx_insert_entry() path, and makes hdr_find_split() return an sp whose sp_size (0xFFF0) greatly exceeds the remaining bytes in the buffer. The u32 subtraction underflows and the memmove count becomes a near-4-GiB value, producing an out-of-bounds kernel write that corrupts adjacent allocations and panics the kernel. Reproduced on 7.0.0-rc7 with UML + KASAN via a crafted image and a single 'touch' inside the mounted directory; crash site resolves to fs/ntfs3/index.c at the memmove. Trigger requires only local mount of an attacker-supplied filesystem image (USB, loopback, or removable media auto-mount). Reject the split whenever the chosen sp plus its declared size already extends past hdr1->used. This is the minimal fix; it preserves the existing hdr_find_split() contract and relies on the same out: cleanup path as the pre-existing error returns. A prior OOB read in the very same indx_insert_into_buffer() memmove was fixed in commit b8c44949044e ("fs/ntfs3: Fix OOB read in indx_insert_into_buffer") by tightening hdr_find_e(), but that fix does not cover the split-point size field path addressed here: sp is returned by hdr_find_split(), not hdr_find_e(), and the underflow is driven by sp->size rather than hdr->used exceeding hdr->total.

References

NVD — CVE-2026-72191 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72191
git.kernel.org/stable/c/1758a564b6... WEB
https://git.kernel.org/stable/c/1758a564b6ebe7f4a82f23c9851d1cae15549457
git.kernel.org/stable/c/4c2f648139... WEB
https://git.kernel.org/stable/c/4c2f648139a0a86f4486170f72e24fedd4fae74e
git.kernel.org/stable/c/7bf74e6baf... WEB
https://git.kernel.org/stable/c/7bf74e6baf810fe325f111996496c678fc6e244f
git.kernel.org/stable/c/8e4ba5a38c... WEB
https://git.kernel.org/stable/c/8e4ba5a38c155bb3c1c11e63cd285b178cdb099e
git.kernel.org/stable/c/b232eb5c9f... WEB
https://git.kernel.org/stable/c/b232eb5c9fe11ec2368e9b565db69c724c35fbd2
git.kernel.org/stable/c/f1df9d771d... WEB
https://git.kernel.org/stable/c/f1df9d771df47aa40de6d70949c28720ae1e430d
git.kernel.org/stable/c/f3624cc069... WEB
https://git.kernel.org/stable/c/f3624cc069195001c88df7a291af215f2133ff2c

Frequently Asked Questions

What is CVE-2026-72191?
CVE-2026-72191 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72191?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72191?
CVE-2026-72191 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-72191?
CVE-2026-72191 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72191?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rw89-wm92-gvrj",
  "modified" : "2026-08-23T15:33:00Z",
  "published" : "2026-08-15T06:32:15Z",
  "aliases" : [ "CVE-2026-72191" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: validate split-point offset in indx_insert_into_buffer\n\nindx_insert_into_buffer() computes\n\n    used = used1 - to_copy - sp_size;\n    memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));\n\nwhere sp and sp_size come from hdr_find_split().  hdr_find_split()\nwalks entries by le16_to_cpu(e->size) without validating that each\nstep stays within hdr->used or that the size field is at least\nsizeof(struct NTFS_DE).  index_hdr_check(), the on-load gatekeeper,\nonly validates header-level fields (used, total, de_off) and does\nnot walk per-entry sizes.\n\nA crafted NTFS image whose leaf INDEX_HDR reports used == total but\ncontains one interior NTFS_DE with size = 0xFFF0 therefore passes\nvalidation, descends to indx_insert_into_buffer() through the\nntfs_create() -> indx_insert_entry() path, and makes hdr_find_split()\nreturn an sp whose sp_size (0xFFF0) greatly exceeds the remaining\nbytes in the buffer.  The u32 subtraction underflows and the memmove\ncount becomes a near-4-GiB value, producing an out-of-bounds kernel\nwrite that corrupts adjacent allocations and panics the kernel.\n\nReproduced on 7.0.0-rc7 with UML + KASAN via a crafted image and a\nsingle 'touch' inside the mounted directory; crash site resolves to\nfs/ntfs3/index.c at the memmove.  Trigger requires only local mount\nof an attacker-supplied filesystem image (USB, loopback, or removable\nmedia auto-mount).\n\nReject the split whenever the chosen sp plus its declared size\nalready extends past hdr1->used.  This is the minimal fix; it\npreserves the existing hdr_find_split() contract and relies on the\nsame out: cleanup path as the pre-existing error returns.\n\nA prior OOB read in the very same indx_insert_into_buffer() memmove\nwas fixed in commit b8c44949044e (\"fs/ntfs3: Fix OOB read in\nindx_insert_into_buffer\") by tightening hdr_find_e(), but that fix\ndoes not cover the split-point size field path addressed here: sp is\nreturned by hdr_find_split(), not hdr_find_e(), and the underflow is\ndriven by sp->size rather than hdr->used exceeding hdr->total.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72191"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1758a564b6ebe7f4a82f23c9851d1cae15549457"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4c2f648139a0a86f4486170f72e24fedd4fae74e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7bf74e6baf810fe325f111996496c678fc6e244f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8e4ba5a38c155bb3c1c11e63cd285b178cdb099e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b232eb5c9fe11ec2368e9b565db69c724c35fbd2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f1df9d771df47aa40de6d70949c28720ae1e430d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f3624cc069195001c88df7a291af215f2133ff2c"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:37Z"
  }
}