MapServer EUVD-2026-32631

Exploitation requires a MapServer 6.4.0-8.6.2 instance exposed via WMS that accepts the SLD_BODY= parameter (user-supplied SLD styling). The malicious payload must be a structurally valid SLD whose <Rule> contains <ElseFilter/> and defines no symbolizer, which forces msSLDParseRule to create zero classes while _SLDApplyRuleValues still indexes class -1. No authentication and no user interaction are required (PR:N/UI:N). The principal limiting factor is configuration: a deployment that does not expose WMS, or does not accept user-controlled SLD via SLD_BODY, is not reachable through this vector.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, with impact confined to availability (no confidentiality or integrity loss). This is a clean denial-of-service primitive - a roughly 200-byte SLD reliably crashes the parser - making it trivially repeatable against any internet-facing WMS endpoint that accepts user-supplied SLD via SLD_BODY. Tempering that, exploitation is currently no public exploit identified at time of analysis, the CVE is not in CISA KEV, and EPSS data was not provided, so widespread active exploitation cannot be asserted. SSVC decision data was also not supplied. Net assessment: a genuine availability risk for exposed SLD-enabled WMS deployments that warrants prompt patching, but not a code-execution or data-exposure threat.

An attacker locates an internet-facing MapServer WMS endpoint and issues an unauthenticated request with an SLD_BODY parameter containing a small, well-formed SLD whose <Rule> includes <ElseFilter/> but no symbolizer. Parsing dereferences a NULL pointer and the MapServer process crashes, denying service to legitimate users; the request can be replayed to sustain the outage. No public exploit is identified, but the trigger is described in enough detail to reconstruct easily given AV:N/AC:L.