SZB-95e5709d04
EUVD-2026-113938 reports heap out-of-bounds write in AFFLIB through 3.7.22
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- sshock
- Product
- AFFLIB
- First seen
Summary
The EUVD listing, citing a CVSS v3.1 score of 6.9, says AFFLIB through 3.7.22 has a heap out-of-bounds write in af_get_page(). The flaw can be triggered with crafted AFF images that have mismatched page and sector sizes.
If you use sshock
Check the AFFLIB project for a fixed release
Upgrade AFFLIB past version 3.7.22 when a fix is available
Only open AFF images from trusted sources until patched
What the sources say 1
· Mastodon: “AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes.” Source