EUVD-2026-31517
GHSA-3h27-65jm-6x5p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated deserialization with low complexity (AV:N/AC:L/PR:N/UI:N); manifested impact is information disclosure only, so C:H with I:N/A:N and unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Planetary Computer Pro (GeoCatalog) lets a remote, unauthenticated attacker read sensitive data by sending crafted serialized objects that the service deserializes without validation (CWE-502). The flaw carries a CVSS 3.1 score of 7.5 (confidentiality-only impact) and, per SSVC, is automatable but has no observed exploitation; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.27% probability of exploitation in the next 30 days.
Technical ContextAI
Microsoft Planetary Computer Pro is a cloud-based geospatial data platform whose GeoCatalog component indexes and serves large Earth-observation datasets (satellite imagery, STAC catalogs) over a network API. The root cause is CWE-502, Deserialization of Untrusted Data: the service reconstructs objects from attacker-supplied serialized input without sufficient type or content validation. Insecure deserialization can be leveraged to manipulate application logic - here the manifested impact is information disclosure, meaning the crafted payload coerces the deserializer into revealing data (for example object state, internal references, or backend responses) rather than executing code. The single affected CPE is cpe:2.3:a:microsoft:microsoft_planetary_computer_pro_(geocatalog), confirming the GeoCatalog service as the vulnerable surface.
RemediationAI
Patch available per vendor advisory - Microsoft indicates a fix is available, and because Planetary Computer Pro is a Microsoft-hosted service the remediation is typically applied service-side by the vendor; confirm your environment reflects the update via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41104. No discrete fixed version number is published in the available data, so do not assume a self-installed package version. As compensating controls until you confirm the fix is applied, restrict network reachability to the GeoCatalog API endpoint using Azure network security groups, private endpoints, or firewall rules so only trusted identities and networks can reach it (trade-off: may break legitimate automated clients that call the catalog anonymously), and enable logging/monitoring on the endpoint to detect anomalous serialized-payload requests. Given confidentiality-only impact, prioritize limiting who can reach the service over availability-focused controls.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today