CVE-2026-55211

Summary

surfio has an out-of-bounds read

Severity

critical

CVSS

9.8

EPSS

0.7% (p54)

CWE

CWE-125

Also known as

GHSA-rcr2-hggw-43wm

Published

2026-08-18

Updated

2026-08-18

Advisory details

Impact

Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.

Patches

The bug has been patched in version 0.0.19

References

• https://github.com/advisories/GHSA-rcr2-hggw-43wm
• https://github.com/equinor/surfio/security/advisories/GHSA-rcr2-hggw-43wm
• https://github.com/equinor/surfio/pull/86
• https://github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa
• https://github.com/equinor/surfio/releases/tag/0.0.19

Related advisories

• CVE-2026-96639 — critical · PyPI/Pillow
• GHSA-26w7-cxv4-gfx2 — critical · npm/astro
• CVE-2026-55209 — critical · PyPI/resdata
• CVE-2023-4966 — critical · Citrix NetScaler/Citrix NetScaler ADC and NetScaler Gateway
• CVE-2026-96644 — high · PyPI/Pillow
• CVE-2026-112896 — high · PyPI/Pillow
• CVE-2026-112404 — high · PyPI/Pillow
• CVE-2026-102941 — high · Go/github.com/gomarkdown/markdown

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity