What is the CVSS score of CVE-2026-33721?

CVE-2026-33721 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Mapserver are affected by CVE-2026-33721?

Organizations using version 4.2 and should be aware of moderate risk from CVE-2026-33721, a out-of-bounds write vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-33721?

Within 30 days: Identify affected systems running version 4.2 and and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mapserver CVE-2026-33721

EUVD-2026-16501 MEDIUM

Out-of-bounds Write (CWE-787)

2026-03-27 GitHub_M

Buffer Overflow Memory Corruption Mapserver

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

8.6.1

EUVD ID Assigned

Mar 27, 2026 - 00:45 euvd

EUVD-2026-16501

Analysis Generated

Mar 27, 2026 - 00:45 vuln.today

CVE Published

Mar 27, 2026 - 00:15 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

AnalysisAI

MapServer versions 4.2 through 8.6.0 are vulnerable to a heap buffer overflow in the SLD (Styled Layer Descriptor) parser that allows remote, unauthenticated attackers to crash the MapServer process by sending a crafted SLD document containing more than 100 Threshold elements within a ColorMap/Categorize structure. The vulnerability is reachable via WMS GetMap requests using the SLD_BODY parameter, requiring no authentication or user interaction. Vendor-released patch: version 8.6.1 eliminates the issue; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

MapServer is a web-based geographic information system (GIS) application server that processes map requests via standard web services including WMS (Web Map Service). The SLD (Styled Layer Descriptor) specification is an XML-based standard for styling geographic data layers. The vulnerability resides in MapServer's SLD parser logic when processing the ColorMap/Categorize element structure, which is used to define color mappings for raster data classification. The root cause is a heap buffer overflow (CWE-787: Out-of-bounds Write) triggered when the parser allocates a fixed-size buffer for Threshold child elements but fails to validate the actual count, causing a write beyond allocated memory when more than 100 thresholds are present. This memory corruption occurs in a process handling untrusted input from WMS requests, making it network-accessible without prior authentication.

RemediationAI

Upgrade MapServer to version 8.6.1 or later immediately. See the vendor security advisory at https://github.com/MapServer/MapServer/security/advisories/GHSA-cv4m-mr84-fgjp and release notes at https://github.com/MapServer/MapServer/releases/tag/rel-8-6-1 for patched version availability and installation instructions. If immediate upgrade is not feasible, implement network-level mitigations: restrict WMS GetMap access to trusted IP ranges, deploy a Web Application Firewall (WAF) configured to reject WMS requests with SLD_BODY parameters containing deeply nested or anomalously large XML payloads, and consider disabling SLD support entirely if not required by client applications. Monitor MapServer process logs for unexpected crashes and implement process restart automation (e.g., systemd restarts) as a temporary stability measure pending patching.