{"id":"CVE-2026-119601","kind":"vulnerability","aliases":["CVE-2026-119601"],"related":[],"title":"AFFLIB: crafted AFF images corrupt heap memory and crash forensic tools","description":"AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.","summary":"AFFLIB, a library for reading Advanced Forensics Format disk images, has a heap out-of-bounds write in af_get_page() when page and sector sizes are mismatched. A crafted AFF image can corrupt heap memory and crash tools that open it, and the sources do not say whether code execution is possible.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["afflib","forensics","linux","package"],"not_affected_if":["no-aff-images","trusted-input-only"],"how_to_check":"- Check whether any tool on your systems links against AFFLIB or ships it, for example `dpkg -l | grep -i afflib` or `rpm -qa | grep -i afflib`\n- Confirm the installed AFFLIB version against the range in the advisory (through `3.7.22`)","fix":null,"status":"open","published_at":"2026-10-30T14:16:48+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:45+00:00","updated_at":"2026-10-30T14:32:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T14:32:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AFFLIB: crafted AFF images corrupt heap memory and crash forensic tools","impact":"medium","summary":"AFFLIB, a library for reading Advanced Forensics Format disk images, has a heap out-of-bounds write in af_get_page() when page and sector sizes are mismatched. A crafted AFF image can corrupt heap memory and crash tools that open it, and the sources do not say whether code execution is possible.","audience":"developers","category":"package","nicknames":[],"who_cares":["afflib","forensics","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"crafted image crashes forensic tools; memory corruption may allow more","analyst_note":"Check the NVD entry and upstream AFFLIB project for a fixed version and whether the heap write is exploitable beyond a crash.","how_to_check":"- Check whether any tool on your systems links against AFFLIB or ships it, for example `dpkg -l | grep -i afflib` or `rpm -qa | grep -i afflib`\n- Confirm the installed AFFLIB version against the range in the advisory (through `3.7.22`)","plain_action":"","needs_analyst":true,"not_affected_if":["no-aff-images","trusted-input-only"],"who_is_affected":"Teams that run forensic tooling or scripts that open AFF disk images with AFFLIB 3.7.22 or earlier are exposed when they process untrusted images. Systems that never open AFF files, or that only handle images they created themselves, are unlikely to be affected. The sources do not say whether a fixed version exists.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4165,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119601':14A,17A '-2026':13A,16A '3.7.22':78C 'advanc':27B 'af':41B,89C 'aff':3A,53B,102C 'afflib':1A,18B,22B,76C 'allow':93C 'attack':94C,110C 'bound':38B,85C 'buffer':137C 'caus':126C 'code':72B 'contain':79C 'corrupt':5A,56B,96C 'craft':2A,52B,101C 'crash':9A,60B,139C 'cve':12A,15A 'disk':30B 'execut':73B 'fill':131C 'forens':10A,19B,28B,140C 'format':29B 'get':42B,90C 'heap':6A,34B,57B,81C,97C 'imag':4A,31B,54B,103C 'larger':116C 'librari':24B 'linux':20B 'loop':132C 'memori':7A,58B,98C 'mismatch':50B,105C 'multipl':121C 'open':63B 'out-of-bound':35B,82C 'packag':21B 'page':43B,45B,91C,106C,114C 'past':135C 'possibl':75B 'read':26B 'say':70B 'sector':47B,108C,124C,128C 'set':112C 'size':48B,109C,115C,125C 'sourc':67B 'suppli':100C 'tool':11A,61B,141C 'vulner':87C 'whether':71B 'write':39B,86C,134C 'zero':130C 'zero-fil':129C","nicknames":[],"mitigations":[],"who_affected":"Teams that run forensic tooling or scripts that open AFF disk images with AFFLIB 3.7.22 or earlier are exposed when they process untrusted images. Systems that never open AFF files, or that only handle images they created themselves, are unlikely to be affected. The sources do not say whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T14:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119601","severity":null,"published_at":"2026-10-30T14:16:48+00:00","modified_at":"2026-10-30T14:16:48+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}