Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-55211surfio IRAP header size fields cause out-of-bounds reads

Critical 9.8

In plain English

A critical-severity out-of-bounds read in surfio from equinor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)9.8Critical
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untrusted files are parsed. The severity assumes surfio is used to parse untrusted files in a networking context such as a web service. This issue is fixed in version 0.0.19.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIsurfio0.0.19GHSA-rcr2-hggw-43wm
PyPIsurfio0.0.19PYSEC-2026-3701

Affected products (as reported)

VendorProductVersions
equinor surfio < 0.0.19

Weakness: CWE-125 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References