CVE-2026-111158: EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect
EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2ISVALIDHEADER to msr3parse() or ms3detect(), over-reading up to 8 bytes and potentially crashing the process.
Affected Software
Event History
Frequently Asked Questions
What input conditions trigger the out-of-bounds read?
A truncated miniSEED 2 record buffer between 40 and 47 bytes can trigger the issue if it passes MS2_ISVALIDHEADER and is provided to msr3_parse() or ms3_detect(). The functions may then read up to 8 bytes beyond the supplied buffer.
What impact is documented for a successful trigger?
The documented impact is a process crash caused by the heap out-of-bounds read. No confidentiality or integrity impact is stated.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges are required, but user interaction is required. Exploitation is local rather than network-based according to the provided severity vector.
Which versions are affected?
EarthScope libmseed through version 3.5.4 is affected.