EUVD-2026-101134
GHSA-c64r-37fg-rgvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted .cgns/.adf file to victim
-
ExploitVictim parses file with CGNS tool (cgnslist)
-
ExecutionNon-NUL end tag drives OOB read in ADFI_read_node_header
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to parse an attacker-supplied .cgns or .adf file using a CGNS/ADF tool (e.g. cgnslist) whose ADF node header contains a non-NUL-terminated end tag; this causes ADFI_stridx_c to scan past disk_node_data. Specific prerequisites and limiting factors: the attacker must deliver the crafted file locally and the victim must open/process it (UI:P, AV:L) - there is no remote or network-triggered path and no authentication is needed by the attacker. Impact is limited to a process crash of the parsing tool (availability only); it does not yield code execution, data disclosure, or integrity loss. Affects CGNS versions through 4.5.2. |
| Impact | This is a low-priority, low-real-risk issue despite the vulnerability class name. The CVSS 4.0 score of 4.8 (vector AV:L/AC:L/AT:N/PR:N/UI:P) reflects the reality: the attack is LOCAL (the attacker must get a crafted .cgns/.adf file onto the target and have a CGNS tool parse it), requires passive user interaction (opening/processing the file), and produces ONLY a low availability impact (VA:L) - a crash. There is NO confidentiality (VC:N), integrity (VI:N), or subsequent-system impact. Publicly available exploit code exists (a hackmd technical writeup and a VulnCheck advisory), which raises reproducibility, but POC availability is NOT active exploitation. This CVE is NOT in CISA KEV, so there is no public exploit identified as being used in the wild - exploitation status is 'publicly available exploit code exists.' No EPSS score and no SSVC decision data were provided in the input, so exploitation-probability and automatability signals cannot be weighed here - this absence should be noted rather than assumed low. The signals are mutually consistent (local vector + crash-only impact + POC-but-no-KEV all point to a denial-of-service nuisance in a developer/engineering tool), so there is no conflict to flag. Net: a reproducible DoS crash of CLI/parsing tools, not a remote code execution or data-exposure threat. |
| Exploit ScenarioDerived | An attacker distributes a malicious CGNS/ADF data file (for example via a shared mesh/simulation dataset) whose ADF node end tag is not NUL-terminated. When an engineer processes it with a CGNS tool such as cgnslist, ADFI_stridx_c scans past disk_node_data causing a stack out-of-bounds read that crashes the application. A public POC/technical writeup exists, and because the attack is local with passive user interaction, success depends on convincing the victim to open the crafted file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Parsing a crafted ADF node header in CGNS through 4.5.2 triggers a stack out-of-bounds read that can crash downstream tools such as cgnslist, giving an attacker a local denial-of-service against the parsing application. The flaw lives in ADFI_read_node_header (src/adf/ADF_internals.c), where an end tag that is not NUL-terminated causes ADFI_stridx_c to scan past the disk_node_data buffer. Publicly available exploit code exists (a HackMD proof-of-concept write-up referenced in the CVE record), but there is no confirmed active exploitation per CISA KEV, and there is no remote or network-triggered path: the victim must locally open an attacker-supplied .cgns or .adf file, and the worst outcome is a process crash with no code execution, data disclosure, or integrity loss.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary action is to avoid feeding untrusted .cgns, .adf, or other ADF-based files into CGNS-linked tools such as cgnslist until upstream fixes ADFI_read_node_header; track the upstream repository at https://github.com/CGNS/CGNS and the vulnerable source line https://github.com/CGNS/CGNS/blob/3a972d92559787a49c5f9a54974ea1946ecb9d21/src/adf/ADF_internals.c#L6828 for a fix commit. Where untrusted files must be processed, run the parser in a sandboxed, unprivileged process with strict memory/CPU limits (for example a container with a read-only filesystem and seccomp profile) so an out-of-bounds read terminates only that disposable process rather than a production service-at the cost of added operational overhead and possible false-positive crashes; alternatively, integrate a local code change that NUL-terminates or bounds-checks the end tag inside ADFI_stridx_c/ADFI_read_node_header before scanning, which requires maintaining a downstream fork. Because exploitation demands a user deliberately opening the crafted file and yields only a crash, the residual risk is low; organizations that cannot sandbox or patch should restrict CGNS file ingestion to trusted, validated datasets and monitor the VulnCheck advisory page for a released fix version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CGNS (CFD General Notation System) is an open-source standard and library for storing computational fluid dynamics data, and the ADF (Advanced Data Format) layer is its low-level binary container format. The affected function, ADFI_read_node_header, parses node headers out of that binary structure and relies on ADFI_stridx_c to locate string delimiters such as the end tag; when a crafted header supplies a non-NUL-terminated end tag, the scanning routine walks past the bounds of the disk_node_data buffer instead of stopping. This is a classic CWE-125 out-of-bounds read: the parser reads memory it does not own, which in practice manifests as a segmentation fault or abort in the consuming tool rather than a controllable memory-corruption primitive. The CPE cpe:2.3:a:cgns:cgns:*:*:*:*:*:*:*:* confirms the affected component is the CGNS library itself across all versions up to and including 4.5.2, with the vulnerable code pointed to directly in the upstream repository at ADF_internals.c line 6828. Because the bug is exercised only when an application parses an untrusted file, it is a local, user-interaction-dependent input-validation defect with availability-only consequences (AV:L, UI:R, A:N), consistent with CWE-125 and with the assigned CVSS 3.1 vector.
Know when Cgns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
File must be opened locally by a user so AV:L and UI:R; attacker needs no privileges (PR:N); impact is a crash only, so A:L with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB