CVE-2026-55211 surfio IRAP header size fields cause out-of-bounds reads
Attackers can trigger out-of-bounds reads and potential code execution by providing malicious IRAP files to applications using the surfio library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55211?
CVE-2026-55211 is a critical memory corruption vulnerability in equinor surfio, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untrusted files are parsed. The severity assumes surfio is used to parse untrusted files in a networking context such as a web service. This issue is fixed in version 0.0.19.
Weakness: CWE-125
Which versions are affected by CVE-2026-55211?
3 open source packages ship an affected version, including surfio.
| Package | Affected | Fixed in |
|---|---|---|
surfio PyPI | All versions | 0.0.19 |
surfio PyPI | All versions | 0.0.19 |
surfio PyPI | All versions | 0.0.19 |
How do I fix CVE-2026-55211?
Upgrade surfio to 0.0.19 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-55211 being exploited?
There is no known exploitation of CVE-2026-55211 in the wild and no public exploit code.
Sources
Also known as GHSA-rcr2-hggw-43wm, PYSEC-2026-3701.