What is the CVSS score of CVE-2026-33147?

CVE-2026-33147 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gmt are affected by CVE-2026-33147?

A critical vulnerability in GMT (Generic Mapping Tools) version 6.6.0 and earlier allows remote attackers to execute arbitrary code or cause service disruptions through specially crafted dataset…

How to fix or mitigate CVE-2026-33147?

Within 24 hours: Identify all systems running GMT 6.6.0 or earlier and document their criticality and network exposure. Within 7 days: Implement network segmentation to restrict GMT access to trusted internal networks only, disable the 'which' module if operationally feasible, and establish input validation on dataset identifiers where possible. Within 30 days: Establish a continuous monitoring process for patch release; prepare an upgrade plan to the next patched GMT version when available; conduct security testing on upgraded systems before production deployment.

Gmt CVE-2026-33147

EUVD-2026-13784 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-20 GitHub_M

Stack Overflow Buffer Overflow RCE Gmt

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 20:30 euvd

EUVD-2026-13784

Analysis Generated

Mar 20, 2026 - 20:30 vuln.today

CVE Published

Mar 20, 2026 - 20:10 nvd

HIGH 7.3

DescriptionGitHub Advisory

GMT is an open source collection of command-line tools for manipulating geographic and Cartesian data sets. In versions from 6.6.0 and prior, a stack-based buffer overflow vulnerability was identified in the gmt_remote_dataset_id function within src/gmt_remote.c. This issue occurs when a specially crafted long string is passed as a dataset identifier (e.g., via the which module), leading to a crash or potential arbitrary code execution. This issue has been patched via commit 0ad2b49.

Articles & Coverage 1

medium.com CVE-2026-33147: Stack Buffer Overflow in GMT/PyGMT Remote Code Execution Apr 23, 2026

AnalysisAI

Stack-based buffer overflow in GMT versions 6.6.0 and earlier allows local attackers to crash the application or execute arbitrary code by supplying an excessively long dataset identifier to vulnerable functions like gmt_remote_dataset_id. The vulnerability affects command-line processing of geographic data and currently lacks a public patch, leaving all affected GMT installations exposed to local exploitation.

Technical ContextAI

GMT (Generic Mapping Tools) is an open source collection of command-line utilities for processing geographic and Cartesian datasets, widely used in geoscience research and mapping applications. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) and resides in the gmt_remote_dataset_id function within src/gmt_remote.c. This function improperly handles user-supplied dataset identifiers without adequate bounds checking, allowing an overly long string to overflow the stack buffer. The affected product is identified via CPE as cpe:2.3:a:genericmappingtools:gmt:*:*:*:*:*:*:*:*, indicating the core GMT application. Stack-based buffer overflows are particularly dangerous as they can overwrite return addresses and function pointers, enabling attackers to redirect program execution flow.

RemediationAI

Users should immediately upgrade to a patched version of GMT that includes commit 0ad2b491470df82c9ec1139dcbd70502fa28a082, which addresses the stack-based buffer overflow in the gmt_remote_dataset_id function. The patch details are available at https://github.com/GenericMappingTools/gmt/commit/0ad2b491470df82c9ec1139dcbd70502fa28a082 and the security advisory at https://github.com/GenericMappingTools/gmt/security/advisories/GHSA-fqxx-62x7-9gwg. Until patching is completed, organizations should implement defense-in-depth measures such as restricting the processing of untrusted or external datasets, running GMT tools with minimal privileges in sandboxed environments, and validating dataset identifiers before passing them to GMT functions. Input validation should specifically check for excessively long strings in dataset identifiers to prevent buffer overflow conditions.