Mapserver EUVD-2026-16501

The CVSS v3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a network-accessible, low-complexity attack with no privilege or interaction requirements that causes availability loss (denial of service). The confidentiality and integrity impacts are zero, limiting the threat to process crashes. Real-world risk is moderate: the attack vector is straightforward (HTTP GET/POST via WMS), complexity is low (crafting malformed XML), and unauthenticated access is available. However, the impact is limited to availability (DoS), not data breach or code execution. No EPSS score, KEV status, or public POC data were provided; therefore, active exploitation cannot be confirmed. This is a legitimate DoS vulnerability meriting prompt patching in production MapServer deployments serving public WMS endpoints, but not a critical threat to confidentiality or system control. Organizations with internal-only MapServer instances or those behind authentication/WAF filters face lower immediate risk.

An attacker crafts an HTTP GET request to a publicly accessible MapServer WMS endpoint with an SLD_BODY parameter containing a malformed SLD XML document with a ColorMap/Categorize element defining 101 Threshold children, exceeding the parser's internal buffer allocation. When the MapServer process parses this request, the buffer overflow writes beyond allocated heap memory, corrupting adjacent data structures and causing a process crash or segmentation fault. The MapServer service becomes unavailable until manually restarted, constituting a denial of service. The attack requires no authentication, no special tools beyond curl or a web browser, and can be automated to sustain repeated crashes.