AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.9 · sshockNVD modified 2026-10-30 13:18
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/sshock/AFFLIBv3/issues/61 issue-tracking
- https://github.com/sshock/AFFLIBv3/blob/v3.7.22/lib/afflib_pages.cpp#L309-L315 technical-description
- https://hackmd.io/@haindpwn/afflib-aff-get-page-sector-fill-oob-write third-party-advisory
- https://github.com/sshock/AFFLIBv3 product
- https://www.vulncheck.com/advisories/afflib-through-3.7.22-heap-out-of-bounds-write-in-af-get-page third-party-advisory