CVE-2026-50126
Received Received - Intake

Memory Corruption in Adaguc-server via Malformed GeoJSON

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry contains a malformed coordinate. The coordinate parser in `adagucserverEC/CConvertGeoJSON.cpp` indexes `pt.u.array.values[0]` and `pt.u.array.values[1]` and uses `polygon.u.array.length` as a loop bound without first validating the JSON node type or the coordinate length. A coordinate that is an empty array, a one-element array, a scalar, or `null` leads to an out-of-bounds heap read or a NULL pointer dereference. The same unchecked pattern is present in four geometry branches: `Polygon`, `LineString`, `MultiLineString` and `MultiPolygon`. The vulnerable parser runs whenever the server processes a local GeoJSON file, either a configured GeoJSON dataset or a GeoJSON file exposed through the `AutoResource` feature and requested by an unauthenticated WMS request. A crafted GeoJSON file reliably crashes the backend process that handles that request. Version 7.2.2 patches the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-50126
EUVD
EUVD-2026-61048

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adaguc adaguc-server to 7.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50126 is a memory-safety vulnerability in adaguc-server, a system for visualizing meteorological data. The issue occurs when parsing malformed GeoJSON files with improperly formatted coordinates. The server crashes due to out-of-bounds heap reads or NULL pointer dereferences when processing geometries like Polygon, LineString, MultiLineString, or MultiPolygon. The flaw stems from unchecked array indexing in the coordinate parser, which fails to validate JSON node types or coordinate lengths before accessing array elements.

Detection Guidance

To detect this vulnerability, monitor for crashes in adaguc-server processes when processing GeoJSON files. Check server logs for SIGSEGV errors or memory-safety faults. Inspect GeoJSON files in configured datasets or AutoResource paths for malformed coordinates like empty arrays, single-element arrays, or null values.

Impact Analysis

This vulnerability can cause the adaguc-server backend to crash when processing a malicious GeoJSON file, leading to denial-of-service conditions. The attack requires no authentication but needs the crafted file to be accessible to the server, either as a configured dataset or via the AutoResource feature. The primary impact is reduced availability of the server, as the backend process handling the request terminates unexpectedly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a memory-safety issue in a GIS server causing crashes. However, availability impacts from denial-of-service could indirectly affect data access required for compliance reporting.

Mitigation Strategies

Upgrade adaguc-server to version 7.2.2 or later. Validate all GeoJSON files for proper coordinate formatting before processing. Restrict access to GeoJSON datasets and AutoResource features to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart