CVE-2026-119601: AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

Q: Who is exposed to this issue?

Systems or forensic workflows that process attacker-supplied AFF images with AFFLIB through 3.7.22 are exposed. The issue is locally triggered, so an attacker must get a crafted image opened or processed by a vulnerable tool.

Q: Does exploitation require authentication or elevated privileges?

No privileges are required according to the provided vector. Exploitation does require user interaction: a user or automated workflow must process the crafted AFF image.

Q: What makes an AFF image malicious for this vulnerability?

The image uses mismatched page and sector sizes, with a page size larger than the sector size and not an exact multiple of it. This causes the sector zero-fill loop in af_get_page() to write beyond the allocated buffer.

Q: What can happen when the issue is triggered?

The crafted image can corrupt heap memory and crash the forensic tool processing it. The supplied data identifies availability impact as high and integrity impact as low, with no confidentiality impact.

Published Oct 30, 2026

Updated

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in afgetpage() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.

Affected Software

4 affected components

debian/afflib*

debian/afflib<=3.7.20-1, <=3.7.21-1, <=3.7.22-3

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·02:16 PM

Affected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems or forensic workflows that process attacker-supplied AFF images with AFFLIB through 3.7.22 are exposed. The issue is locally triggered, so an attacker must get a crafted image opened or processed by a vulnerable tool.

Does exploitation require authentication or elevated privileges?

No privileges are required according to the provided vector. Exploitation does require user interaction: a user or automated workflow must process the crafted AFF image.

What makes an AFF image malicious for this vulnerability?

The image uses mismatched page and sector sizes, with a page size larger than the sector size and not an exact multiple of it. This causes the sector zero-fill loop in af_get_page() to write beyond the allocated buffer.

What can happen when the issue is triggered?

The crafted image can corrupt heap memory and crash the forensic tool processing it. The supplied data identifies availability impact as high and integrity impact as low, with no confidentiality impact.

CVE-2026-119601: AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require authentication or elevated privileges?

What makes an AFF image malicious for this vulnerability?

What can happen when the issue is triggered?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require authentication or elevated privileges?

What makes an AFF image malicious for this vulnerability?

What can happen when the issue is triggered?