Opens100
Monthly
Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.
Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.