UBUNTU-CVE-2026-119601: Medium severity ubuntu/afflib vulnerability
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in afgetpage() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using AFFLIB through 3.7.22 are exposed when forensic tools process AFF images supplied by an attacker or another untrusted source.
What does an attacker need to exploit it?
The attacker needs to provide a crafted AFF image with a page size that is larger than, and not a multiple of, the sector size. Exploitation occurs when affected code processes that image.
What is the likely impact?
The crafted image can cause an out-of-bounds heap write in af_get_page(), corrupting heap memory and crashing the forensic tool. The reported impact includes low integrity impact and high availability impact.
How can I determine whether I may be affected?
Identify whether your environment uses AFFLIB and determine its version. Versions through 3.7.22 are identified as affected, particularly where the software processes untrusted AFF images.