CVE catalog
CVE-2023-26266
aflplusplus: CVE-2023-26266
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.40% · Oct 25, 2026
In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | aflplusplus | sid | 5.02c-0.5 | fixed |
| Debian | aflplusplus | forky | 5.02c-0.5 | fixed |
| Debian | aflplusplus | trixie | 4.21c-5 | fixed |
| Debian | aflplusplus | bookworm | 4.04c-4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | aflplusplus | source | sid | 4.04c-4 | not yet assigned | Not reported | [1033255] |
| Debian | aflplusplus | source | forky | 4.04c-4 | not yet assigned | Not reported | [1033255] |
| Debian | aflplusplus | source | trixie | 4.04c-4 | not yet assigned | Not reported | [1033255] |
| Debian | aflplusplus | source | bookworm | 4.04c-4 | not yet assigned | Not reported | [1033255] |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.