CVE-2026-55211 — surfio IRAP header size fields cause out-of-bounds reads
Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untru…
Published: 2026-09-15 · CVSS: 9.8 · CVSS 3.0
Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untrusted files are parsed. The severity assumes surfio is used to parse untrusted files in a networking context such as a web service. This issue is fixed in version 0.0.19.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7