Microsoft AVML Symlink Truncation Vulnerability

Executive Summary

CVE-2026-61371 is a vulnerability in Microsoft AVML versions before 0.17.0 where the tool follows symlinks when opening a destination output path on Unix systems. This allows a local attacker to create a symlink pointing to a critical file, causing AVML to truncate or overwrite the target file before validating the input. The issue occurs because AVML uses O_TRUNC without O_NOFOLLOW, enabling immediate destructive action on the symlink target.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with local access to overwrite or delete important files on your system by exploiting AVML's symlink handling. If AVML is used to capture memory dumps, an attacker could replace the intended output file with a symlink to a system-critical file, causing data loss or corruption. The impact includes compromised system integrity and availability.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of Microsoft AVML installed on your system. Run: avml --version. If the version is below 0.17.0, the system is vulnerable. Additionally, monitor for unexpected file truncations or overwrites in directories where AVML writes output.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Microsoft AVML to version 0.17.0 or later. If upgrading is not possible, avoid using AVML in environments where untrusted users have access to the output directory. Restrict write permissions to the output path to prevent symlink creation.

Useful 0 Not Useful 0