CVE-2026-55209

Summary

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Severity

critical

CVSS

9.8

EPSS

0.8% (p56)

CWE

CWE-120, CWE-125, CWE-129, CWE-476

Also known as

GHSA-pr85-w493-9w3x

Published

2026-08-18

Updated

2026-08-18

Advisory details

Impact

Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice.

Patches

The bug has been patched starting with version 6.2.9.

References

• https://github.com/advisories/GHSA-pr85-w493-9w3x
• https://github.com/equinor/resdata/security/advisories/GHSA-pr85-w493-9w3x
• https://github.com/equinor/resdata/releases/tag/6.2.9

Related advisories

• CVE-2026-107220 — medium · Go/github.com/xuri/excelize/v2
• CVE-2026-107222 — medium · Go/github.com/xuri/excelize/v2
• CVE-2026-59949 — medium · Maven/at.yawk.lz4:lz4-java
• CVE-2026-96639 — critical · PyPI/Pillow
• GHSA-26w7-cxv4-gfx2 — critical · npm/astro
• CVE-2026-55211 — critical · PyPI/surfio
• CVE-2023-4966 — critical · Citrix NetScaler/Citrix NetScaler ADC and NetScaler Gateway
• CVE-2026-96644 — high · PyPI/Pillow

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity