CVE-2026-61371 Details
Description
Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).
A vulnerability in Microsoft AVML versions prior to 0.17.0 allows the application to follow symlinks when opening destination output paths on Unix. This behavior can lead to the unintentional truncation or overwriting of the symlink target. The issue arises because the file is opened with the O_TRUNC option, causing immediate truncation before proper input validation is completed. As a result, even if an invalid input is detected later, the original content of the target file is already lost.
Users can upgrade to Microsoft AVML version 0.17.0 or later, where this vulnerability has been fixed by adding O_NOFOLLOW to the Unix destination open, preventing symlink following during file creation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |