CVE-2026-45104: MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and SLDApplyRuleValues ends up indexing class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLDBODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45104?
The severity of CVE-2026-45104 is rated as high with a score of 7.5.
How do I fix CVE-2026-45104?
To fix CVE-2026-45104, upgrade your MapServer to version 8.6.3 or later.
What does CVE-2026-45104 affect?
CVE-2026-45104 affects MapServer versions from 6.4.0 up to but not including 8.6.3.
What type of vulnerability is CVE-2026-45104?
CVE-2026-45104 is a null pointer dereference vulnerability that can cause application crashes.
How can CVE-2026-45104 be exploited?
CVE-2026-45104 can be exploited via a crafted Web Map Service (WMS) request containing specific SLD elements.