EUVD-2026-16501Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
AnalysisAI
MapServer versions 4.2 through 8.6.0 are vulnerable to a heap buffer overflow in the SLD (Styled Layer Descriptor) parser that allows remote, unauthenticated attackers to crash the MapServer process by sending a crafted SLD document containing more than 100 Threshold elements within a ColorMap/Categorize structure. The vulnerability is reachable via WMS GetMap requests using the SLD_BODY parameter, requiring no authentication or user interaction. Vendor-released patch: version 8.6.1 eliminates the issue; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
MapServer is a web-based geographic information system (GIS) application server that processes map requests via standard web services including WMS (Web Map Service). The SLD (Styled Layer Descriptor) specification is an XML-based standard for styling geographic data layers. The vulnerability resides in MapServer's SLD parser logic when processing the ColorMap/Categorize element structure, which is used to define color mappings for raster data classification. The root cause is a heap buffer overflow (CWE-787: Out-of-bounds Write) triggered when the parser allocates a fixed-size buffer for Threshold child elements but fails to validate the actual count, causing a write beyond allocated memory when more than 100 thresholds are present. This memory corruption occurs in a process handling untrusted input from WMS requests, making it network-accessible without prior authentication.
RemediationAI
Upgrade MapServer to version 8.6.1 or later immediately. See the vendor security advisory at https://github.com/MapServer/MapServer/security/advisories/GHSA-cv4m-mr84-fgjp and release notes at https://github.com/MapServer/MapServer/releases/tag/rel-8-6-1 for patched version availability and installation instructions. If immediate upgrade is not feasible, implement network-level mitigations: restrict WMS GetMap access to trusted IP ranges, deploy a Web Application Firewall (WAF) configured to reject WMS requests with SLD_BODY parameters containing deeply nested or anomalously large XML payloads, and consider disabling SLD support entirely if not required by client applications. Monitor MapServer process logs for unexpected crashes and implement process restart automation (e.g., systemd restarts) as a temporary stability measure pending patching.
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 al
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connecti
Denial of service in MapServer 6.4.0 through 8.6.2 allows remote unauthenticated attackers to crash the server by submit
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when
Reflected XSS in MapServer 6.0 through 8.6.1 allows unauthenticated remote attackers to inject arbitrary HTML and JavaSc
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 doe
MapServer is a system for developing web-based GIS applications. Rated high severity (CVSS 8.9), this vulnerability is r
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today