CVE-2026-33721 MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

What is CVE-2026-33721?

CVE-2026-33721 is a medium-severity memory corruption vulnerability in MapServer, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Weakness: CWE-787

Which versions are affected by CVE-2026-33721?

It affects 1 product.

Products include Osgeo Mapserver.

How do I fix CVE-2026-33721?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-33721 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33721 exists.

Other vulnerabilities in MapServer

• CVE-2010-2540 Security feature bypass in n/a Critical 10.0
• CVE-2009-2281 Memory corruption in n/a Critical 10.0
• CVE-2009-0839 Memory corruption in n/a Critical 10.0
• CVE-2009-0840 Memory corruption in n/a Critical 10.0
• CVE-2009-0841 Path traversal in n/a Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-33721, GHSA-cv4m-mr84-fgjp, UBUNTU-CVE-2026-33721, openSUSE-SU-2026:10452-1, openSUSE-SU-2026:20476-1.