EUVD-2026-98233
GHSA-636c-c9vm-prrj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious S-102 HDF5 file
-
ExploitVictim opens file in OpenS100
-
ExecutionInteger overflow undersizes heap buffer
-
ImpactOut-of-bounds write triggers crash or code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open a crafted S-102 Bathymetric Surface HDF5 file whose grid-dimension metadata (numPointsLatitudinal and numPointsLongitudinal) are set so their product overflows a 32-bit integer in S102_VG_BathymetryCoverage::Read(). No authentication is required (PR:N), but exploitation is limited by mandatory user interaction (UI:A - the file must be actively opened) and a local attack vector (AV:L - no network reach), plus higher attack complexity (AC:H). Affects OpenS100 up to commit daaa35b; the S-102 parsing path must be invoked on the malicious file. |
| Impact | Signals point to a real but low-priority issue rather than an urgent threat. The CVSS 4.0 base score of 7.1 (High) is driven by full VC:H/VI:H/VA:H impact (potential RCE), but the exploitability metrics heavily constrain it: AV:L means the attacker cannot reach the code over a network, AC:H reflects non-trivial conditions, and UI:A requires the victim to actively open a malicious file. Notably, the description claims 'remote attackers' while the CVSS vector is explicitly AV:L (local) - this is a genuine conflict; the realistic model is social-engineering/file-delivery (attacker-controlled file opened locally), not direct remote exploitation, so treat 'remote' as loose phrasing and defer to AV:L. EPSS is very low (0.20%, 10th percentile), there is no CISA KEV listing, and no evidence of active exploitation - so despite a public POC existing, this is exploit-code-available, not in-the-wild. The low EPSS is consistent with a niche, file-interaction-dependent bug in specialized software. Net: a legitimate memory-corruption flaw worth patching, but prioritization should sit well below network-reachable or actively-exploited CVEs. |
| Exploit ScenarioDerived | An attacker crafts a malicious S-102 bathymetric HDF5 file whose numPointsLatitudinal and numPointsLongitudinal grid-dimension metadata are set to large values, then delivers it to a victim (e.g., via email, download, or a shared chart dataset). When the victim opens the file in OpenS100, the unvalidated multiplication wraps a 32-bit integer, undersizing the heap allocation and causing out-of-bounds writes that crash the application or potentially execute code. A public POC/exploit is available, but exploitation is local and requires the user to open the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.
Earlier versions of this analysis (1)
Opening a crafted S-102 bathymetric HDF5 file in OpenS100 (all versions through commit daa35b) can crash the application or, depending on heap layout, achieve arbitrary code execution in the victim's session. The flaw is a 32-bit integer wraparound in S102_VG_BathymetryCoverage::Read(), where the product of numPointsLatitudinal and numPointsLongitudinal is not validated, causing an undersized heap allocation followed by out-of-bounds writes. Publicly available exploit code exists, and the CVSS 4.0 base score of 8.4 reflects high confidentiality, integrity, and availability impact, though exploitation is conditional: the assessed vector is local (AV:L) with mandatory user interaction (UI:R) and no attacker authentication (PR:N), meaning an attacker must convince or induce a target to open a malicious bathymetric file rather than triggering the flaw autonomously over a network.
RemediationAI
No vendor-released patch version is identified in the available data, and the affected range runs through commit daaa35b, so the first step is to confirm current upstream status against the VulnCheck advisory (https://www.vulncheck.com/advisories/opens100-s-102-parser-integer-overflow-heap-buffer-overflow), VulDB 417462 (https://vuldb.com/vuln/417462) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-35001) and upgrade as soon as a fixed commit or release is published. Until then, apply compensating controls that address the actual trigger: treat every S-102 HDF5 file from an untrusted source as hostile and pass it through a validating pre-processor that opens the file, reads the grid dimension attributes and rejects datasets whose numPointsLatitudinal × numPointsLongitudinal product exceeds a sane bound or overflows 32 bits - this stops the malformed metadata before it reaches S102_VG_BathymetryCoverage::Read(), with the trade-off that legitimate very-large bathymetric grids above the chosen ceiling will also be rejected and the validator must itself use checked 64-bit arithmetic. If such validation cannot be implemented, disable or remove the S-102 parsing path and ship only S-100 products that are not affected, at the cost of losing S-102 bathymetry support entirely. Additional containment: run OpenS100 with least privilege and inside a sandbox or container with no access to sensitive data, so a successful heap overflow cannot escalate into code execution in a privileged context, and restrict the sources from which users are permitted to open S-102 files (for example, no downloads from untrusted portals or transmittal by email), noting that these measures reduce blast radius but do not remove the underlying memory-corruption bug.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenS100 is an open-source implementation of the IHO S-100 framework and derived product specifications, and the affected code path parses S-102 Bathymetric Surface datasets, which are delivered as HDF5 containers. The root cause is CWE-190 (Integer Overflow or Wraparound): in S102_VG_BathymetryCoverage::Read(), grid dimension metadata (numPointsLatitudinal multiplied by numPointsLongitudinal) is multiplied without range validation, so a crafted pair of dimensions can overflow a 32-bit integer. The wrapped value is then used to size a heap allocation, producing an undersized buffer that is subsequently populated with data sized to the true (non-wrapped) dimensions, i.e. a heap-based out-of-bounds write. Because the size arithmetic and the write occur in the same read routine, no authentication or elevated privilege is required once a malicious file is supplied; the practical constraints come from the binary parsing model (a local file must be opened by the victim) and the careful dimension crafting needed to turn the wraparound into a usable overflow. The CPE cpe:2.3:a:opens100_project:opens100:*:*:*:*:*:*:*:* uses a wildcard version, indicating the defect is present across the project's release line rather than in a single tagged build, and the issue is tracked under EUVD-2026-98233 with a dedicated VulnCheck advisory.
Know when Opens100 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation requires opening a local crafted file, so AV:L and UI:R with PR:N; the overflow is trivially triggered by crafted metadata (AC:L), yielding potential code execution (C/I/A:H), no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenS100 through commit daa35b contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. Attackers can exploit the unvalidated multiplication of numPointsLatitudinal and numPointsLongitudinal values in the S102_VG_BathymetryCoverage::Read() function to trigger a 32-bit integer wraparound, resulting in undersized heap buffer allocation and subsequent out-of-bounds writes that lead to application crash or arbitrary code execution.
Executive ViewAI
OpenS100, a tool for viewing S-102 bathymetric data, is affected by a high-severity vulnerability (CVE-2026-35001) that can crash the application or potentially allow arbitrary code execution when a user opens a malicious file. The attack is unauthenticated but requires local user interaction, and while publicly available exploit code exists, the exploitation probability is low (EPSS ~0.2%). Leadership should ensure that users handling untrusted bathymetric files are aware of the risk and take precautionary measures, as successful exploitation could lead to system compromise or data integrity issues.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the opening of untrusted S-102 HDF5 files, implementing strict file content validation, running OpenS100 in a sandboxed or isolated environment, and monitoring vendor advisories for an update.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB