{"id":"CVE-2026-33721","aliases":["DEBIAN-CVE-2026-33721","EUVD-2026-16501","GHSA-cv4m-mr84-fgjp","UBUNTU-CVE-2026-33721","openSUSE-SU-2026:10452-1","openSUSE-SU-2026:20476-1","openSUSE-SU-2026:20857-1"],"status":"published","title":"MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0122,"percentile":0.6905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-03-27T00:15:00Z","modified":"2026-10-31T18:00:08Z","fixes":[{"ecosystem":"Debian:12","package":"mapserver","fixed_in":["8.0.0-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mapserver","fixed_in":["8.4.0-4+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mapserver","fixed_in":["8.6.1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mapserver","fixed_in":["8.6.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"mapserver","fixed_in":["8.6.1-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-3+deb12u1"}]}],"versions":["8.0.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-4+deb13u2"}]}],"versions":["8.4.0-4","8.4.0-4+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.1-1"}]}],"versions":["8.4.0-4","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-4build1","7.0.0-5ubuntu1","7.0.0-7","7.0.0-8","7.0.0-8build1","7.0.0-9","7.0.0-9ubuntu1","7.0.0-9ubuntu2","7.0.0-9ubuntu3","7.0.0-9ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.6-2build1","7.0.7-1","7.0.7-1build1","7.0.7-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.1-1build1","7.4.1-1build3","7.4.2-1","7.4.2-1build1","7.4.3-1","7.4.3-1build2","7.4.3-2","7.4.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1~exp1ubuntu1","7.6.4-2","7.6.4-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-2build1","8.0.1-2build2","8.0.1-2build3","8.0.1-2build5","8.0.1-4ubuntu1","8.0.1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-1build1","8.4.0-4","8.4.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.0-1build1","8.6.4-1","8.6.5-1","8.6.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-4build1","8.4.1-1","8.4.1-1build1","8.4.1-2","8.4.1-2build1","8.6.0-1","8.6.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.1-bp160.1.1"}]}]}],"products":[{"vendor":"mapserver","product":"mapserver"},{"vendor":"osgeo","product":"mapserver"}],"references":[{"url":"https://github.com/MapServer/MapServer/security/advisories/GHSA-cv4m-mr84-fgjp","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://github.com/MapServer/MapServer/releases/tag/rel-8-6-1","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00017.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33721.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33721","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33721","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33721","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33721","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33721","tags":["web"]},{"url":"https://bugzilla.suse.com/1260869","tags":["report"]},{"url":"https://bugzilla.suse.com/1266663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45104","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-33721","title":"MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","status":"published","published":"2026-03-27T00:15:00.36Z","modified":"2026-04-17T17:18:03.353Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-16501","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","status":"published","published":"2026-03-27T00:15:00Z","modified":"2026-04-17T17:18:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:23.330761Z"}],"nvd":[{"id":"CVE-2026-33721","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","status":"published","published":"2026-03-27T01:16:19.67Z","modified":"2026-06-17T10:37:59.19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-33721","title":"MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","status":"published","published":"2026-03-27T00:15:00.36Z","modified":"2026-10-28T02:30:26.6557353Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"DEBIAN-CVE-2026-33721","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","status":"published","published":"2026-03-27T01:16:19.67Z","modified":"2026-10-01T03:03:22.547235086Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-33721","description":"MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.","status":"published","published":"2026-03-27T01:16:00Z","modified":"2026-10-17T12:58:10.947237298Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"openSUSE-SU-2026:10452-1","title":"libjavamapscript-8.6.1-1.1 on GA media","description":"These are all security issues fixed in the libjavamapscript-8.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-28T00:00:00Z","modified":"2026-03-29T10:45:53.154062Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20476-1","title":"Security update for mapserver","description":"This update for mapserver fixes the following issues:\n\nChanges in mapserver:\n\n- Update to release 8.6.1\n  * msSLDParseRasterSymbolizer: fix potential heap buffer overflow\n    [boo#1260869] [CVE-2026-33721]\n  * GetFeatureInfo with IDENTIFY CLASSAUTO: take into account\n    SYMBOL.ANCHORPOINT\n  * WCS 2.0: fix issue when input raster in a rotated pole lon/lat\n    CRS with lon_0 \u003e 180\n  * UVRaster: fix WMS-Time support on layers with TILEINDEX\n    pointing to a shapefile\n  * WMS GetCapabilities response: use group title and abstract when\n    using wms_layer_group instead of GROUP\n\n- Update to release 8.6.0\n  * Add `CONNECTIONTYPE RASTERLABEL`\n  * Set `MS_LEGEND_KEYSIZE_MAX` to 1000\n  * Add 4 new `COMPOSITE.COMPOP` blending operations\n  * Allow encryption key files to use paths relative to a mapfile\n  * Allow `use_default_extent_for_getfeature` to be used for OGC\n    Features API and PostGIS\n  * Allow append of additional query parameters for OGCAPI\n  * New MapServer index page\n  * WMS `GetFeatureInfo`: add options to precisely identify points\n    through their symbols\n  * Add `FALLBACK` parameter for the `CLASS` object, to be applied\n    if none of the previously defined classes has been applied\n","status":"published","published":"2026-10-30T17:08:42Z","modified":"2026-10-31T18:00:08.597620505Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20857-1","title":"Security update for mapserver","description":"This update for mapserver fixes the following issues:\n\nChanges in mapserver:\n\n- Update to releasee 8.6.3\n  * SLD parser: fix out of bounds access on SLD with only a Rule\n    with a ElseFilter but without a symbolizer\n    [CVE-2026-33721, boo#1260869] [CVE-2026-45104, boo#1266663]\n","status":"published","published":"2026-06-01T16:05:47Z","modified":"2026-06-03T08:30:27.382749496Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}