CVE-2026-33721

MEDIUM

MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

Title source: cna

Description

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

References (2)

[X_Refsource_Confirm] https://github.com/MapServer/MapServer/security/advisories/GHSA-cv4m-mr84-fgjp

[X_Refsource_Misc] https://github.com/MapServer/MapServer/releases/tag/rel-8-6-1

Scores

CVSS v3 5.3

EPSS 0.0007

EPSS Percentile 21.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE

CWE-787

Status published

Products (1)

MapServer/MapServer < >= 4.2, < 8.6.1

Published Mar 27, 2026

Tracked Since Mar 27, 2026