Bug 2564046 (CVE-2026-119601)

Summary: CVE-2026-119601 afflib: afflib: Denial of Service via crafted AFF image
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in afflib. An attacker could exploit this vulnerability by supplying a specially crafted Advanced Forensic Format (AFF) image file containing mismatched page and sector sizes. When processed by an affected tool, this flaw causes a heap out-of-bounds write, resulting in memory corruption and a Denial of Service (DoS) through an application crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565489, 2565491, 2565492, 2565495, 2565498, 2565500    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 14:08:17 UTC 
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.