CVE-2026-55209: Out-of-bounds Read
Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice.
Patches The bug has been patched starting with version 6.2.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/resdatato a version that resolves this vulnerability.Fixed in 6.2.9 - Upgrade
Upgrade
resdatato a version that resolves this vulnerability.Fixed in 6.2.9
Event History
Frequently Asked Questions
Which deployments are most exposed?
Exposure is highest where resdata parses untrusted GRDECL files received through a network-facing workflow, such as a web service. The stated severity assumes this type of deployment.
What does exploitation require?
An attacker needs to supply a malformed or otherwise invalid GRDECL file for resdata to parse. No privileges or user interaction are required according to the supplied severity vector.
Which versions should be remediated?
Versions before 6.2.9 are affected. Upgrade to resdata 6.2.9 or later, where the input-validation issue is patched.