Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2026-111158EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect
Medium 5.5
In plain English
A medium-severity out-of-bounds read in libmseed from EarthScope. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 97.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmseed | no fix listed | DEBIAN-CVE-2026-111158 |
| Debian:13 | libmseed | no fix listed | DEBIAN-CVE-2026-111158 |
| Debian:14 | libmseed | no fix listed | DEBIAN-CVE-2026-111158 |
| Ubuntu:22.04:LTS | libmseed | no fix listed | UBUNTU-CVE-2026-111158 |
| Ubuntu:24.04:LTS | libmseed | no fix listed | UBUNTU-CVE-2026-111158 |
| Ubuntu:26.04:LTS | libmseed | no fix listed | UBUNTU-CVE-2026-111158 |
| Ubuntu:26.10 | libmseed | no fix listed | UBUNTU-CVE-2026-111158 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EarthScope | libmseed | 0 – through 3.5.4 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://hackmd.io/@haind-pwn/libmseed-ms3detect-short-header-oob-read technical-description, exploit
- https://github.com/EarthScope/libmseed/blob/d6e6ad306de5b7bdde072e5a5e3d58ddcc11abd8/parseutils.c#L192-L234 technical-description
- https://github.com/EarthScope/libmseed/commit/c93a36a1381e944b59b10967342ee1cb94304223 patch
- https://github.com/EarthScope/libmseed product
- VulnCheck Advisory: EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect third-party-advisory