Stack Out-of-Bounds Read in CGNS Library

Executive Summary

CVE-2026-110661 is a stack out-of-bounds read vulnerability in the CGNS library affecting versions up to 4.5.2. It occurs in the ADF file handling code when processing maliciously crafted .cgns or .adf files. The vulnerability stems from improper handling of node headers where a non-NUL-terminated end tag causes the function ADFI_stridx_c to read beyond allocated memory, leading to application crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect CGNS files (.cgns or .adf) for malformed node headers. Use tools like cgnslist to process files and check for crashes. Monitor system logs for application crashes when handling these files. Validate file integrity by comparing checksums of known-good files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash applications that process CGNS files, such as cgnslist, by supplying specially crafted files. While it does not directly execute arbitrary code, it can disrupt workflows relying on CGNS tools, cause data processing failures, and potentially lead to denial-of-service conditions in affected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes application crashes by triggering out-of-bounds memory reads when processing malformed ADF files. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. However, crashes could disrupt systems handling sensitive data, potentially leading to service interruptions that may affect compliance if critical operations are impacted.

Useful 0 Not Useful 0

Mitigation Strategies

Update CGNS to the latest version beyond 4.5.2. Avoid opening untrusted .cgns or .adf files. Implement file validation checks before processing. Restrict access to CGNS tools to trusted users only.

Useful 0 Not Useful 0