CVE-2026-55211: Buffer Overflow
Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.
Patches The bug has been patched in version 0.0.19
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/surfioto a version that resolves this vulnerability.Fixed in 0.0.19 - Upgrade
Upgrade
surfioto a version that resolves this vulnerability.Fixed in 0.0.19
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments that use surfio to parse untrusted IRAP files in a network-facing context, such as a web service, are the exposure scenario assumed by the severity rating.
What does exploitation require?
An attacker needs to supply a crafted IRAP file with invalid size fields to a vulnerable parser. The listed vector indicates network-reachable exploitation with no privileges or user interaction required in the assumed deployment scenario.
What version fixes the issue?
Upgrade surfio to version 0.0.19 or later. The size-field validation issue is patched in version 0.0.19.