Executive brief
Microsoft AVML, a tool used for acquiring volatile memory for forensic analysis, is vulnerable to a file handling flaw on Unix-based systems. A local attacker could trick the tool into overwriting or deleting important system files by placing a symbolic link at the location where the tool expects to save its output. This could lead to a loss of system integrity or a service outage, even if the tool ultimately fails to complete its task.
Technical details
A symlink following vulnerability (CWE-59) exists in Microsoft AVML before version 0.17.0 on Unix-like systems. The root cause is the use of Rust's OpenOptions with 'create(true)' and 'truncate(true)' without specifying 'O_NOFOLLOW' via custom flags. An attacker with local access to the output directory can create a symbolic link at the intended output path; when AVML is executed, the kernel follows the link and truncates the target file. This 'truncation-before-validation' occurs at open-time, meaning the target file is cleared even if AVML subsequently fails due to invalid input. The issue is fixed in version 0.17.0 by adding O_NOFOLLOW to the destination file open call.
Affected products
- Microsoft AVML before 0.17.0
Timeline
- 2026-03-06: patched: Fix merged in PR 754 and released in v0.17.0
- 2026-07-15: advisory: CVE-2026-61371 published