CVE-2026-119601 in AFFLIB
Summary
by MITRE • 10/30/2026
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The Advanced Forensic Format library, commonly known as AFFLIB, is a widely used open-source toolset designed for creating and managing disk images in the AFF format. This format was developed specifically for digital forensics to ensure data integrity through built-in checksums and compression capabilities. While primarily utilized by law enforcement agencies, incident responders, and security researchers, its underlying codebase has historically been susceptible to memory corruption vulnerabilities due to complex handling of binary image structures. The specific vulnerability identified in versions up to 3.7.22 resides within the af_get_page function, which is responsible for retrieving data pages from an AFF file. This component plays a critical role in parsing the internal structure of forensic images, making it a high-value target for exploitation by adversaries seeking to compromise systems that process such files.
The technical root cause of this vulnerability is a heap-based out-of-bounds write condition triggered by malformed input parameters within the image metadata. Specifically, the flaw occurs when an attacker constructs an AFF image where the declared page size exceeds the sector size and is not a multiple thereof. During the processing of these images, af_get_page initiates a loop intended to zero-fill sectors that are smaller than the requested page size. However, due to insufficient boundary checks regarding the relationship between page size and sector size, this loop calculates an incorrect buffer length or offset. Consequently, when the function attempts to write zeros into the allocated memory buffer, it writes past the end of the heap-allocated region. This behavior constitutes a classic out-of-bounds write vulnerability, allowing arbitrary data to be written to adjacent memory locations that may contain sensitive information or control structures critical for program execution flow.
From an operational perspective, this vulnerability poses significant risks to forensic workstations and automated analysis pipelines. The immediate impact is often the crash of the forensic tooling application due to a segmentation fault triggered by accessing invalid heap memory. However, in more sophisticated scenarios where attackers can precisely craft the malformed image data, they may achieve arbitrary code execution on the target system. This could allow an adversary to gain unauthorized access to sensitive evidence stored on the machine, exfiltrate confidential investigation materials, or establish persistence within the forensic environment. Since AFF files are often exchanged between different entities in legal and investigative contexts, a maliciously crafted image sent via email or uploaded to a shared repository can serve as an effective attack vector against unsuspecting analysts who open the file without rigorous validation of its integrity beforehand.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-787, which describes out-of-bounds write vulnerabilities involving heap memory corruption. It also maps to MITRE ATT&CK techniques related to initial access via malicious files and potential privilege escalation if the forensic tool runs with elevated privileges. To mitigate this risk, organizations relying on AFFLIB should immediately upgrade to version 3.7.23 or later, where developers have implemented stricter validation checks for page and sector size relationships before initiating memory operations. Additionally, security teams should enforce strict input sanitization policies when processing external digital evidence files. Implementing sandboxed environments for analyzing untrusted forensic images can further reduce the blast radius of any potential exploitation attempts. Regular patch management cycles are essential to ensure that known vulnerabilities in foundational libraries like AFFLIB do not become entry points for broader system compromise.