CVE-2023-26266 – Gentoo Linux Security Advisory 202408-27

https://notcve.org/view.php?id=CVE-2023-26266

21 Feb 2023 — In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution. A vulnerability has been discovered in AFLplusplus, which can lead to arbitrary code execution via an untrusted CWD. Versions greater than or equal to 4.06c are affected. • https://github.com/AFLplusplus/AFLplusplus/pull/1643 •