Every CVE Search/ Get API key

CVE-2026-33721

MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

5.3 MediumFix available

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.22%Up 1.1 points since Mar 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Record
CVE-2026-33721
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-16501 5.3

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Record
EUVD-2026-16501
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
NVD 5.3

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Record
CVE-2026-33721
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 5.3

MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Record
CVE-2026-33721
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-33721 7.5

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Record
DEBIAN-CVE-2026-33721
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33721 5.3

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Record
UBUNTU-CVE-2026-33721
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10452-1 No score

libjavamapscript-8.6.1-1.1 on GA media

These are all security issues fixed in the libjavamapscript-8.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10452-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20476-1 No score

Security update for mapserver

This update for mapserver fixes the following issues:

Changes in mapserver:

  • Update to release 8.6.1

    • msSLDParseRasterSymbolizer: fix potential heap buffer overflow [boo#1260869] [CVE-2026-33721]
    • GetFeatureInfo with IDENTIFY CLASSAUTO: take into account SYMBOL.ANCHORPOINT
    • WCS 2.0: fix issue when input raster in a rotated pole lon/lat CRS with lon_0 > 180
    • UVRaster: fix WMS-Time support on layers with TILEINDEX pointing to a shapefile
    • WMS GetCapabilities response: use group title and abstract when using wms_layer_group instead of GROUP

  • Update to release 8.6.0

    • Add CONNECTIONTYPE RASTERLABEL
    • Set MS_LEGEND_KEYSIZE_MAX to 1000
    • Add 4 new COMPOSITE.COMPOP blending operations
    • Allow encryption key files to use paths relative to a mapfile
    • Allow use_default_extent_for_getfeature to be used for OGC Features API and PostGIS
    • Allow append of additional query parameters for OGCAPI
    • New MapServer index page
    • WMS GetFeatureInfo: add options to precisely identify points through their symbols
    • Add FALLBACK parameter for the CLASS object, to be applied if none of the previously defined classes has been applied
Record
openSUSE-SU-2026:20476-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20857-1 No score

Security update for mapserver

This update for mapserver fixes the following issues:

Changes in mapserver:

  • Update to releasee 8.6.3
    • SLD parser: fix out of bounds access on SLD with only a Rule with a ElseFilter but without a symbolizer [CVE-2026-33721, boo#1260869] [CVE-2026-45104, boo#1266663]
Record
openSUSE-SU-2026:20857-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mapserver
Debian:12
 before 8.0.0-3+deb12u1, plus listed versions
8.0.0-3
8.0.0-3+deb12u1
mapserver
Debian:13
 before 8.4.0-4+deb13u2, plus listed versions
8.4.0-48.4.0-4+deb13u1
8.4.0-4+deb13u2
mapserver
Debian:14
 before 8.6.1-1, plus listed versions
8.4.0-48.4.1-18.4.1-1~bpo13+18.4.1-28.6.0-1
Show 5 moreShow less
8.6.0-1~bpo13+18.6.0~beta1-1~exp18.6.0~beta2-1~exp18.6.0~rc1-1~exp18.6.1-1~bpo13+1
8.6.1-1
mapserver
Ubuntu:16.04:LTS
 All versions, plus listed versions
7.0.0-4build17.0.0-5ubuntu17.0.0-77.0.0-87.0.0-8build1
Show 5 moreShow less
7.0.0-97.0.0-9ubuntu17.0.0-9ubuntu27.0.0-9ubuntu37.0.0-9ubuntu3.1
 None known
mapserver
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.0.6-2build17.0.7-17.0.7-1build17.0.7-1build2
 None known
mapserver
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.4.1-1build17.4.1-1build37.4.2-17.4.2-1build17.4.3-17.4.3-1build27.4.3-27.4.3-2build1
 None known
mapserver
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.6.3-1~exp1ubuntu17.6.4-27.6.4-2build2
 None known
mapserver
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.0.1-2build18.0.1-2build28.0.1-2build38.0.1-2build58.0.1-4ubuntu18.0.1-4ubuntu2
 None known
mapserver
Ubuntu:25.10
 All versions, plus listed versions
8.4.0-1build18.4.0-48.4.0-4build1
 None known
mapserver
Ubuntu:26.10
 All versions, plus listed versions
8.6.0-1build18.6.4-18.6.5-18.6.5-1build1
 None known
mapserver
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.4.0-4build18.4.1-18.4.1-1build18.4.1-28.4.1-2build18.6.0-18.6.0-1build1
 None known
mapserver
openSUSE:Tumbleweed
 before 8.6.1-1.1
8.6.1-1.1
mapserver
openSUSE:Leap 16.0
 before 8.6.1-bp160.1.1
8.6.1-bp160.1.1

History

History
RecordedChangedSources
facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33721 is a medium vulnerability (CVSS 5.3) in Mapserver, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in mapserver 8.0.0-3+deb12u1.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open