CVE-2026-35001: OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
OpenS100 through commit daa35b contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. Attackers can exploit the unvalidated multiplication of numPointsLatitudinal and numPointsLongitudinal values in the S102VGBathymetryCoverage::Read() function to trigger a 32-bit integer wraparound, resulting in undersized heap buffer allocation and subsequent out-of-bounds writes that lead to application crash or arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required for exploitation?
An attacker must get a user or application to open a crafted S-102 HDF5 file. The vulnerability is triggered by malicious grid dimension metadata in that file.
Are deployments exposed by default?
The issue is reachable when OpenS100 processes S-102 Bathymetric Surface files. The provided information does not identify any configuration setting that disables the affected parser.
What can be done while a fix is unavailable?
Do not open untrusted S-102 HDF5 files, and restrict processing to files from trusted sources. Where feasible, isolate OpenS100 file processing to limit the impact of a crash or code execution.
How can I determine whether a file is attempting to exploit this issue?
Inspect S-102 HDF5 grid dimension metadata for numPointsLatitudinal and numPointsLongitudinal values whose multiplication exceeds 32-bit integer capacity. Such values can cause the undersized allocation and subsequent out-of-bounds writes described.