CVE-2026-55209

Received Received - Intake

Buffer Overflow in resdata GRDECL File Parser

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-55209

Affected Vendors & Products

Vendor	Product	Version / Range
equinor	resdata	to 6.2.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects the resdata library, which is used for reading and writing result files from the Eclipse reservoir simulator. The issue involves insufficient validation of numeric fields, grid dimensions, keyword sizes, and array indexes when parsing untrusted GRDECL files. This can lead to buffer overflows, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination.

Detection Guidance

Detecting this vulnerability requires checking if your resdata library version is prior to 6.2.9. Use commands like 'pip show resdata' or 'conda list resdata' to check the installed version. If the version is below 6.2.9, the system is vulnerable.

Impact Analysis

If you use resdata in a network service that accepts untrusted GRDECL files, an attacker could exploit this vulnerability to cause a buffer overflow or memory corruption. This could lead to remote code execution, data leaks, or service crashes. The vulnerability requires no privileges or user interaction and can be exploited remotely.

Mitigation Strategies

Immediately upgrade the resdata library to version 6.2.9 or later. If using a package manager like pip or conda, run 'pip install --upgrade resdata' or 'conda update resdata'. If integrated into a network service, ensure input validation for GRDECL files is enforced.

Hi! I’m here to help you understand CVE-2026-55209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70