EUVD-2026-78671
GHSA-rcr2-hggw-43wm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adopts the vendor's networked-parser assumption (AV:N/PR:N/UI:N/AC:L); an out-of-bounds READ yields memory disclosure (C:H) and DoS via over-read/over-allocation (A:H) but no integrity impact (I:N).
Primary rating from Vendor (https://github.com/equinor/surfio).
CVSS VectorVendor: https://github.com/equinor/surfio
Lifecycle Timeline
3DescriptionCVE.org
Impact
Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.
Patches
The bug has been patched in version 0.0.19
AnalysisAI
Out-of-bounds read with unbounded memory allocation in the surfio Python/C++ library affects all versions prior to 0.0.19, where the Irap ASCII and binary surface-file parsers trust attacker-controllable ncol/nrow size fields in the header without validating them against the actual input length. A remote attacker who can supply a crafted .irap file to an application that parses it - the vendor explicitly rates severity assuming surfio runs in a networked service - can trigger a memory over-read and force allocation of tens of megabytes from a single tiny value, causing information disclosure or denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target application uses surfio (< 0.0.19) to parse an Irap surface file whose contents the attacker controls or can influence - specifically an .irap file (ASCII or binary) whose header ncol/nrow size fields declare more values than the file body actually holds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8 Critical) reflects a worst-case assumption stated by the vendor itself: that surfio parses untrusted files in a networked web service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 0.0.19 - upgrade surfio to 0.0.19 or later (pip install --upgrade 'surfio>=0.0.19'); the fix is delivered via https://github.com/equinor/surfio/pull/86 and commit 1619750bce28e39c4f378d2fb6d28b72380a12aa, released at https://github.com/equinor/surfio/releases/tag/0.0.19. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using surfio and identify which ones accept .irap files from external or untrusted sources; prioritize those exposed over the network for immediate action. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today