What is the CVSS score of CVE-2026-30479?

CVE-2026-30479 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2026-30479?

OSGeo MapServer versions prior to 8.0 contain a critical remote code execution vulnerability (CVE-2026-30479) allowing unauthenticated attackers to execute arbitrary commands with no user interaction…

How to fix or mitigate CVE-2026-30479?

Within 24 hours: Identify and document all MapServer instances running versions prior to 8.0 across the organization; isolate any internet-facing instances from production networks if possible. Within 7 days: Evaluate upgrade feasibility to MapServer 8.0 or later; if immediate upgrade is infeasible, implement network-level access controls (firewall rules, WAF policies) to restrict external connections to MapServer ports. Within 30 days: Complete upgrade of all affected MapServer instances to version 8.0 or later; validate functionality post-upgrade and document completion.

N A CVE-2026-30479

EUVD-2026-20932 CRITICAL

Code Injection (CWE-94)

2026-04-09 mitre

GHSA-4mx6-xfr3-7q7g

Code Injection RCE N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:25 vuln.today

CVSS changed

Apr 14, 2026 - 17:22 NVD

9.1 (CRITICAL)

EUVD ID Assigned

Apr 09, 2026 - 16:30 euvd

EUVD-2026-20932

CVE Published

Apr 09, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.

AnalysisAI

Remote code execution in OSGeo MapServer versions prior to 8.0 enables unauthenticated attackers to execute arbitrary code through dynamic-link library (DLL) injection via a specially crafted executable. The vulnerability requires no user interaction and has low attack complexity (CVSS 9.1 Critical), though real-world exploitation probability remains low (EPSS 2%, 5th percentile). Publicly available exploit code exists in a researcher's GitHub repository, but no confirmed active exploitation (CISA KEV) has been documented at time of analysis.

Technical ContextAI

This vulnerability exploits CWE-94 (Improper Control of Generation of Code / Code Injection) through Dynamic-link Library injection mechanisms in MapServer, an open-source platform for publishing spatial data and interactive mapping applications to the web. DLL injection is a technique where malicious code forces a legitimate process to load an arbitrary DLL, allowing attackers to execute code within the context of that process. MapServer, written primarily in C and commonly deployed on Windows servers with IIS or Apache, uses dynamic libraries for various geospatial processing functions. The vulnerability likely stems from insufficient validation of library paths or executable components during MapServer's initialization or plugin loading routines, allowing attackers to supply crafted executables that hijack the library loading process and inject malicious DLLs into the MapServer process space.

RemediationAI

Upgrade to OSGeo MapServer version 8.0 or later, which addresses this DLL injection vulnerability. Organizations should download the patched release from the official MapServer project repository at https://mapserver.org/index.html and follow vendor upgrade procedures for their specific deployment environment. For Windows-based installations, verify DLL search path configurations and implement application whitelisting or code integrity policies to prevent unauthorized library loading as defense-in-depth measures during the upgrade window. If immediate upgrade is not feasible, consider network segmentation to restrict MapServer access to trusted networks only, disable unnecessary plugins or extensions, and implement file integrity monitoring on MapServer executable directories. Review system and application logs for suspicious library loading events or unauthorized process behavior. Consult the technical details in the researcher's disclosure at https://github.com/penjaminTester/Research/tree/main/CVE-2026-30479 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-30479 for additional context.