CVE-2026-55211
Received Received - Intake

Buffer Overflow in Surfio Library Due to IRAP File Size Validation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untrusted files are parsed. The severity assumes surfio is used to parse untrusted files in a networking context such as a web service. This issue is fixed in version 0.0.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55211
EUVD
EUVD-2026-78671

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
equinor surfio to 0.0.19 (exc)
surfio surfio to 0.0.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55211 is a buffer overflow vulnerability in the Surfio library prior to version 0.0.19. The issue occurs when Surfio fails to validate size fields in IRAP files, allowing malformed headers to declare more values than the actual buffer contains. This leads to reading or writing outside the intended memory range.

Detection Guidance

To detect this vulnerability, check the version of surfio installed on your system. If it is below 0.0.19, the system is vulnerable. Use commands like 'pip show surfio' or 'conda list surfio' to verify the installed version.

Impact Analysis

If exploited, this vulnerability could allow attackers to access confidential data, modify data integrity, or disrupt system availability. It can be triggered remotely without requiring privileges or user interaction, particularly in networking contexts like web services parsing untrusted files.

Mitigation Strategies

Immediately upgrade surfio to version 0.0.19 or later. This can be done using package managers like pip ('pip install --upgrade surfio') or conda ('conda update surfio'). Ensure all applications using surfio are restarted after the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart