Log in Start free

Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-45104MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

High 7.5

In plain English

A high-severity null pointer dereference in MapServer from MapServer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mapserverno fix listedDEBIAN-CVE-2026-45104
Debian:13mapserverno fix listedDEBIAN-CVE-2026-45104
Debian:14mapserver8.6.3-1DEBIAN-CVE-2026-45104
Ubuntu:22.04:LTSmapserverno fix listedUBUNTU-CVE-2026-45104
Ubuntu:24.04:LTSmapserverno fix listedUBUNTU-CVE-2026-45104
Ubuntu:25.10mapserverno fix listedUBUNTU-CVE-2026-45104
Ubuntu:26.04:LTSmapserverno fix listedUBUNTU-CVE-2026-45104
Ubuntu:26.10mapserverno fix listedUBUNTU-CVE-2026-45104

Affected products (as reported)

VendorProductVersions
MapServer MapServer >= 6.4.0, < 8.6.3

Weakness: CWE-129, CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References