Microsoft AVML before version 0.17.0 could follow a symbolic link when opening a destination output path on Unix, constituting a CWE-59 vulnerability. The program performs an O_TRUNC open before the entire input is validated, allowing an attacker who can create or modify a target symlink to truncate or overwrite the file the link points to. This results in destructive data loss and can potentially compromise important system files.

The affected product is Microsoft AVML, used on Unix-based systems. Any installation of AVML earlier than release 0.17.0 that accepts arbitrary output paths is vulnerable.

The CVSS score is 7.5, indicating medium-to-high severity, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. The likely attack vector is local or remote depending on whether a user can create a writable symlink in the output directory; exploitation requires sufficient file-system permissions to place a symlink that points to a critical target before AVML truncates the file.