CVE-2026-55211: Surfio Library Buffer Overflow Vulnerability

CVE-2026-55211 Overview

Surfio is a C++ library for reading and writing surface files, commonly used to parse IRAP-format geological data. Prior to version 0.0.19, surfio fails to validate size fields declared in IRAP file headers. A crafted file can declare ncol and nrow values that exceed the actual input length, triggering an out-of-bounds read [CWE-125] and buffer overflow during parsing. The flaw affects both ASCII and binary IRAP import paths. Impact escalates when surfio is embedded in networked services that accept untrusted files, such as web APIs or data ingestion pipelines. The maintainers released a fix in surfio 0.0.19.

Critical Impact
Attackers can send a malformed IRAP file to a service using surfio and trigger memory corruption that risks confidentiality, integrity, and availability of the affected process.

Affected Products

equinor/surfio versions prior to 0.0.19
Applications and services embedding surfio for IRAP file parsing
Web services that accept untrusted surface files via surfio

Discovery Timeline

2026-09-15 - CVE-2026-55211 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-55211

Vulnerability Analysis

Surfio parses IRAP surface files through two entry points: get_values in src/lib/irap_import_ascii.cpp and get_values_binary in src/lib/irap_import_binary.cpp. Both functions accepted ncol and nrow values from the file header and computed nvalues = ncol * nrow without checking the result against the actual byte length of the input buffer. The code then allocated a std::vector<float> sized by nvalues and read four bytes per element from the input pointer range.

A malicious file declaring inflated ncol or nrow values causes the loop to read past the end of the input buffer. This yields an out-of-bounds read and can corrupt heap state depending on how the calling application manages memory around the parsed buffer. In a networked context, an unauthenticated remote attacker can supply the file, satisfying the network attack vector without requiring privileges or user interaction.

Root Cause

The root cause is missing bounds validation between header-declared dimensions and the actual input size. The parameter types were also narrow int, which permitted signed multiplication that could produce misleading values before the allocation.

Attack Vector

An attacker delivers a crafted IRAP file to any component that calls surfio's import functions. Delivery paths include HTTP uploads, message queues, or shared storage consumed by an ingest worker. Parsing the file triggers the overflow without further interaction.

cpp

// Patch: src/lib/irap_import_ascii.cpp
   return {head, ptr};
 }
 
-std::vector<float> get_values(const char* start, const char* end, int ncol, int nrow) {
+std::vector<float> get_values(const char* start, const char* end, size_t ncol, size_t nrow) {
   const size_t nvalues = ncol * nrow;
+  if (static_cast<size_t>(end - start) / 4 < nvalues)
+    throw std::length_error("ncol and nrow declared in header exceed length of input");
   auto values = std::vector<float>(nvalues);
   for (auto i = 0u; i < nvalues; ++i) {
     float value;
// Source: https://github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa

The binary parser received the equivalent fix in src/lib/irap_import_binary.cpp. See the GitHub commit for the binary header validation for the matching change to get_values_binary.

Detection Methods for CVE-2026-55211

Indicators of Compromise

Crashes, aborts, or std::length_error exceptions in processes that call surfio import routines
IRAP files whose declared ncol * nrow * 4 exceeds the file size on disk
Unexpected memory growth or segmentation faults in ingest workers processing surface files

Detection Strategies

Inventory applications that depend on equinor/surfio and flag any version earlier than 0.0.19
Scan container images and Python or C++ build manifests for pinned surfio versions below 0.0.19
Add file-format validation in front of surfio that rejects IRAP files whose header dimensions exceed the payload size

Monitoring Recommendations

Alert on repeated crashes of services that parse geoscience or surface files
Log rejected uploads that fail size or header-consistency checks at the application boundary
Track outbound network activity from parsing workers to detect post-exploitation behavior

How to Mitigate CVE-2026-55211

Immediate Actions Required

Upgrade surfio to version 0.0.19 or later across all environments
Rebuild and redeploy any binary or container that statically links or bundles surfio
Restrict IRAP file uploads to authenticated users while patches roll out

Patch Information

The fix is available in the surfio 0.0.19 release. Technical details are documented in the GHSA-rcr2-hggw-43wm advisory and the Pull Request #86. Both parsers now validate ncol and nrow against the input length and throw std::length_error when the declared size exceeds the buffer.

Workarounds

Reject IRAP files at the application layer when ncol * nrow * 4 is greater than the input byte length
Sandbox surfio parsing in a low-privileged process or container to contain memory corruption
Disable IRAP ingestion endpoints exposed to untrusted networks until upgrading to 0.0.19

bash

# Upgrade surfio in a Python project using pip
pip install --upgrade 'surfio>=0.0.19'

# Verify the installed version
python -c "import surfio; print(surfio.__version__)"