AFLplusplus: Arbitrary Code Execution A vulnerability has been discovered in AFLplusplus, which can lead to arbitrary code execution via an untrusted CWD. aflplusplus 2024-08-11 2024-08-11 897924 local 4.06c 4.06c

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.

In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.

There is no known workaround at this time.

All AFLplusplus users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=app-forensics/aflplusplus-4.06c"
CVE-2023-26266 graaff graaff