CVE-2026-61371 describes a vulnerability in Microsoft AVML prior to version 0.17.0 where the software follows symlinks on Unix systems when opening output files. This leads to a truncation-before-validation condition, where the target of a symlink can be truncated or overwritten prematurely during file open operations using O_TRUNC, before the input is fully validated. This can result in destructive modification of files that are symlink targets.

The vulnerability allows an attacker who can control the output path to cause truncation or overwrite of arbitrary files pointed to by symlinks on Unix systems. This can lead to data loss or corruption of files outside the intended scope of the AVML operation. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 0.17.0 or later once available. Until then, avoid running AVML on untrusted input paths that may contain symlinks or restrict the environment to prevent symlink exploitation.