CVE-2026-61371 — Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target

Back Back to CVE browser

HIGH

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target

Published Jul 15, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.53%

Description

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).

Affected products

Remediation

No remediation recorded yet.

Metrics

0.53% 0.00530

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00530

Score over time

Jul–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.53% (0.00530)	42.69th	v5 (v2026.06.15)
Jul 16, 2026	0.36% (0.00361)	28.29th	v5 (v2026.06.15)

Weaknesses (1)

CWE-59

References (3)

Link	Providers	Tags
https://gist.github.com/thesmartshadow/2d099071f847de8db3dc4bbaf4dfa6df		exploit
https://github.com/microsoft/avml/pull/754
https://github.com/microsoft/avml/releases/tag/v0.17.0

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 15, 2026

Updated Jul 15, 2026

Reserved Jul 8, 2026

Link CVE-2026-61371

CISA Vulnrichment

Updated Jul 15, 2026

NVD

Status Awaiting Analysis

Modified Jul 15, 2026

Link CVE-2026-61371

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-61371