CVE-2026-35001

HighCVSS 7.0

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. A crafted HDF5 file with malicious grid metadata can cause memory corruption, leading to a heap-based buffer overflow and potential arbitrary code execution.

Risk Assessment

Opening a malicious file could crash the application or execute arbitrary code in the user's context, compromising data confidentiality and integrity.

Recommendation

Update OpenS100 to a version after commit 2b1dafc that includes the fix, and avoid opening files from untrusted sources.

Other vulnerabilities in OpenS100

CVE-2026-22208Critical
OpenS100 prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing, exposing standard libraries 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue with Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.

Original NVD description (English source)

OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS