{"id":"CVE-2026-30479","aliases":["EUVD-2026-20932","GHSA-4mx6-xfr3-7q7g","UBUNTU-CVE-2026-30479"],"status":"published","title":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows...","description":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00321,"percentile":0.25474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-04-09T00:00:00Z","modified":"2026-10-17T12:58:08Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-4build1","7.0.0-5ubuntu1","7.0.0-7","7.0.0-8","7.0.0-8build1","7.0.0-9","7.0.0-9ubuntu1","7.0.0-9ubuntu2","7.0.0-9ubuntu3","7.0.0-9ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.6-2build1","7.0.7-1","7.0.7-1build1","7.0.7-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.1-1build1","7.4.1-1build3","7.4.2-1","7.4.2-1build1","7.4.3-1","7.4.3-1build2","7.4.3-2","7.4.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1~exp1ubuntu1","7.6.4-2","7.6.4-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-2build1","8.0.1-2build2","8.0.1-2build3","8.0.1-2build5","8.0.1-4ubuntu1","8.0.1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-1build1","8.4.0-4","8.4.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.0-1build1","8.6.4-1","8.6.5-1","8.6.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-4build1","8.4.1-1","8.4.1-1build1","8.4.1-2","8.4.1-2build1","8.6.0-1","8.6.0-1build1"]}],"references":[{"url":"https://mapserver.org/index.html","tags":["report"]},{"url":"https://github.com/penjaminTester/Research/tree/main/CVE-2026-30479","tags":["exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30479"},{"url":"https://github.com/advisories/GHSA-4mx6-xfr3-7q7g"},{"url":"https://ubuntu.com/security/CVE-2026-30479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-30479","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-30479","description":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-04-14T16:35:23.231Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-20932","description":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-04-14T16:35:23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:24:25.607055Z"}],"ghsa":[{"id":"GHSA-4mx6-xfr3-7q7g","title":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows...","description":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.","status":"published","published":"2026-04-09T18:31:27Z","modified":"2026-04-14T18:31:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:07:30.088478Z"}],"nvd":[{"id":"CVE-2026-30479","description":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.","status":"published","published":"2026-04-09T17:16:24.73Z","modified":"2026-06-17T10:32:42.383Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"UBUNTU-CVE-2026-30479","description":"A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.","status":"published","published":"2026-04-09T17:16:00Z","modified":"2026-10-17T12:58:08.386297808Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:11.640778Z"}]}}