AFFLIB EUVD-2026-113938

Exploitation requires an attacker-supplied AFF (Advanced Forensic Format) image in which the page size is set larger than, and not an integer multiple of, the sector size; this triggers the sector zero-fill loop in af_get_page() to write past the heap buffer. The target must be a forensic tool or workflow using AFFLIB through 3.7.22 that parses the malicious image. Limiting factors: the attack is local (the crafted image must be processed on the victim system) and depends on user/operator interaction (an examiner opening or ingesting the untrusted image, per UI:P), with no authentication qualifier derivable beyond PR:N; it does not reach over the network and produces primarily a crash/denial-of-service of the forensic tool.

Signals point to a moderate, forensics-specific issue rather than a broad emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) describes a local, low-complexity flaw that still requires passive user interaction - a forensic operator must open or process an attacker-supplied AFF image - and the impact is weighted toward availability (VA:H) with only low integrity impact (VI:L) and no confidentiality impact (VC:N). Per the evidence the outcome is heap corruption that crashes the tool; it is CWE-787 (out-of-bounds write), so memory corruption is confirmed, but the sources describe a crash, not demonstrated code execution - do not treat this as confirmed RCE. Exploitation status: no CISA KEV listing, so this is not confirmed actively exploited; a public PoC/write-up reference exists (hackmd analysis plus the VulnCheck advisory), but it is not verified as working exploit code. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vuln.today decision label is 'this_month' - a scheduled-remediation priority, not act_now/emergency - which is consistent with the medium CVSS of 6.9 and the narrow, interaction-dependent attack surface. Net: a real but bounded bug for environments running AFFLIB-based forensic tooling, driven by denial-of-service against analysts processing untrusted images, not a widespread network-exploitable threat.

An attacker crafts a malicious AFF forensic image whose page size is larger than and not a multiple of the sector size, then gets it into an investigation pipeline (e.g., evidence submitted for analysis or seized media). When a forensic examiner opens the image in a tool built on AFFLIB ≤3.7.22, af_get_page()'s sector zero-fill loop writes past the heap buffer, corrupting memory and crashing the tool. A public PoC reference/write-up exists but is not verified as working exploit code.