CVE-2026-55209: resdata GRDECL Buffer Overflow Vulnerability

CVE-2026-55209 Overview

CVE-2026-55209 is a buffer overflow vulnerability in resdata, an open-source library maintained by Equinor for reading and writing result files from the Eclipse reservoir simulator. Versions prior to 6.2.9 insufficiently validate numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files. The flawed parsing occurs in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths. Unbounded floating-point conversion can exceed the intended parser buffer, leading to memory corruption or service termination.

Critical Impact
A network service accepting untrusted GRDECL files can suffer classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, or memory corruption, enabling remote code execution or denial of service.

Affected Products

Equinor resdata versions prior to 6.2.9
Applications embedding the resdata GRDECL parser
Network services that accept untrusted GRDECL files via resdata

Discovery Timeline

2026-09-14 - CVE-2026-55209 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55209

Vulnerability Analysis

The vulnerability is a classic buffer overflow [CWE-120] in the GRDECL parser used by resdata. The parser reads reservoir grid definition keywords from text files without enforcing size constraints on numeric fields, keyword lengths, or array indexes. When an attacker supplies a crafted GRDECL file, malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES blocks reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths. The parser then reads or writes outside allocated buffers.

Unbounded sscanf conversions using the %g floating-point specifier can also exceed the fixed 64-byte parser buffer. This produces memory corruption on the stack or heap. In a network-facing service consuming GRDECL data, the flaw allows remote attackers to trigger crashes or potentially execute arbitrary code with the privileges of the parsing process.

Root Cause

The root cause is missing input validation across multiple parsing paths in rd_kw_grdecl.cpp and rd_grid.cpp. Numeric field widths were not constrained during sscanf conversion, keyword sizes were not bounds-checked against grid dimensions, and array indexes for CORSNUM and ACTNUM were dereferenced without validation. These missing checks converge into exploitable buffer overflows and out-of-bounds accesses.

Attack Vector

Exploitation requires an attacker to supply a crafted GRDECL file to a service or application that parses reservoir data with resdata. No authentication or user interaction is required when the file reaches a network-accessible parsing endpoint. The attack can achieve denial of service through NULL pointer dereference or crash, and may achieve memory corruption suitable for code execution.

cpp

// Security patch: increase parser buffer and add size specifiers to sscanf
// Source: https://github.com/equinor/resdata/commit/d3f45828e9413506b8e8160a9304f4b7b06dcefc
    char newline = '\n';
    bool atEOF = false;
    size_t init_size = 32;
-    size_t buffer_size = 64;
+    size_t buffer_size = 256;
    size_t data_index = 0;
    int sizeof_ctype = rd_type_get_sizeof_ctype(data_type);
    size_t data_size = init_size;

cpp

// Security patch: bounds-check CORSNUM and ACTNUM arrays
// Source: https://github.com/equinor/resdata/commit/ee8cc12b026d945df3077bc98e211ee45f80a433
 #include <cstring>
 #include <cstdio>
 #include <cmath>
+#include <cinttypes>

 #include <vector>
 #include <unordered_map>

Detection Methods for CVE-2026-55209

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that call into resdata when parsing GRDECL input.
GRDECL files containing oversized numeric tokens or keyword sizes inconsistent with declared grid dimensions.
Anomalous memory allocation patterns or heap corruption reports during reservoir data ingestion.

Detection Strategies

Inventory applications and services that link against resdata and identify versions below 6.2.9.
Instrument parsing processes with AddressSanitizer or Valgrind in test environments to surface out-of-bounds reads and writes.
Inspect ingestion pipelines for unauthenticated endpoints that accept .GRDECL or .grdecl files from external users.

Monitoring Recommendations

Alert on repeated process crashes or restarts in reservoir simulation and data processing workloads.
Monitor file uploads containing GRDECL keywords (COORD, ZCORN, CORSNUM, ACTNUM, MAPAXES) from untrusted sources.
Collect and centralize application logs from services embedding resdata for post-incident forensics.

How to Mitigate CVE-2026-55209

Immediate Actions Required

Upgrade resdata to version 6.2.9 or later in all environments that parse GRDECL files.
Rebuild and redeploy any downstream applications statically linked against vulnerable resdata versions.
Restrict network exposure of services that accept untrusted GRDECL input until patched.

Patch Information

Equinor released the fix in resdata 6.2.9. The patch adds size specifiers to sscanf calls with the %g format, increases the parser buffer from 64 to 256 bytes, validates the size of GRDECL keywords, and adds bounds-checking of CORSNUM and ACTNUM arrays. Refer to the GitHub Security Advisory GHSA-pr85-w493-9w3x, GitHub Release 6.2.9, and GitHub Pull Request #1166 for details.

Workarounds

Only process GRDECL files from trusted sources and validate file provenance before parsing.
Sandbox the parsing process with reduced privileges, seccomp filters, or container isolation to limit blast radius.
Apply pre-parse validation to reject GRDECL files with keyword sizes inconsistent with declared grid dimensions.

bash

# Upgrade to the patched release
pip install --upgrade resdata>=6.2.9

# Or build from source at the patched tag
git clone https://github.com/equinor/resdata.git
cd resdata
git checkout 6.2.9
cmake -B build && cmake --build build