Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-55209resdata insufficiently validates untrusted GRDECL files

Critical 9.8

In plain English

A critical-severity buffer overflow in resdata from equinor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 43.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIresdata6.2.9GHSA-pr85-w493-9w3x
PyPIresdata6.2.9PYSEC-2026-3694

Affected products (as reported)

VendorProductVersions
equinor resdata < 6.2.9

Weakness: CWE-120, CWE-125, CWE-129, CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References