libmseed EUVD-2026-102285

Exploitation requires that an application built on libmseed <= 3.5.4 call msr3_parse() or ms3_detect() on attacker-controlled input, and that the input be a 40-to-47-byte buffer short of the full MS2FSDH_LENGTH fixed header yet still passing the MS2_ISVALIDHEADER validation so that the vulnerable blockette-offset read is reached. Limiting factors: the attack is local (AV:L) and needs passive user interaction (UI:P) - a victim or automated pipeline must actually feed the malformed miniSEED 2 record to the parser; no authentication is needed (PR:N) but there is no network-triggerable default path, and the outcome is limited to a process crash with no confidentiality or integrity impact.

This is a genuine but low-severity defect whose signals are internally consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:N/VI:N/VA:H) describes a local, low-complexity, unauthenticated issue that requires passive user interaction (a victim parsing attacker-supplied data) and whose only impact is availability - there is no confidentiality or integrity impact despite the CWE-125 out-of-bounds read, because the over-read bytes are not returned to the attacker. Publicly available exploit code exists (a hackmd technical write-up), which raises practical exploitability, but the CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The realistic worst case is a process crash (denial of service) in an application embedding libmseed, not code execution or data theft. No EPSS value was supplied, so exploitation probability cannot be quantified; treat the public PoC as the strongest exploitation signal. Net: a real, confirmed, patch-worthy bug for anyone embedding libmseed in an exposed parsing pipeline, but a low-urgency, low-blast-radius issue rather than a high-priority emergency.

An attacker crafts a truncated 40-to-47-byte miniSEED 2 record that still satisfies the MS2_ISVALIDHEADER check and delivers it to a service or tool that calls msr3_parse() or ms3_detect() on libmseed <= 3.5.4. When the parser reads the blockette-offset field beyond the truncated fixed header, it over-reads up to 8 bytes of heap memory, potentially crashing the process. A public proof-of-concept write-up describing this condition already exists, and because the vector is local with required user interaction, exploitation depends on getting the malformed buffer in front of the parser.