CVE-2026-33721— MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing
Quick assessment
Affected
MapServer MapServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mapserver是开源地理空间（Osgeo）基金会的一套用于将空间数据和交互式地图应用程序发布到Web的开源平台。 MapServer 8.6.1之前版本存在缓冲区错误漏洞，该漏洞源于SLD解析器存在堆缓冲区溢出写入，可能导致远程未经验证的攻击者通过特制SLD使进程崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33721
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing
Source: CVE Program / CVE List V5
Vulnerability Description
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Vulnerability Title
Mapserver 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mapserver是开源地理空间（Osgeo）基金会的一套用于将空间数据和交互式地图应用程序发布到Web的开源平台。 MapServer 8.6.1之前版本存在缓冲区错误漏洞，该漏洞源于SLD解析器存在堆缓冲区溢出写入，可能导致远程未经验证的攻击者通过特制SLD使进程崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-33721
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33721
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-33721 (1)
Vendor Pages for CVE-2026-33721 (1)
-
Release MapServer 8.6.1 · MapServer/MapServer · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: MapServer
-
CVE-2026-54355
MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP -
CVE-2026-54354
MapServer: PostGIS Numeric Filter Value SQL Injection in Map -
CVE-2026-45104
MapServer: NULL pointer dereference in SLD `<ElseFilter>` ru -
CVE-2026-42030
MapServer: Improper Neutralization of Script-Related HTML Ta -
CVE-2025-59431
MapServer - WFS XML Filter Query SQL injection
Same vendor: MapServer
-
CVE-2026-54355
MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP -
CVE-2026-54354
MapServer: PostGIS Numeric Filter Value SQL Injection in Map -
CVE-2026-45104
MapServer: NULL pointer dereference in SLD `<ElseFilter>` ru -
CVE-2026-42030
MapServer: Improper Neutralization of Script-Related HTML Ta -
CVE-2025-59431
MapServer - WFS XML Filter Query SQL injection
Same weakness: CWE-787
-
CVE-2026-109831
GNU UnRTF 越界写入漏洞致拒绝服务 -
CVE-2026-19595
Zephyr RTIO syscall verifier validates output parameters for -
CVE-2026-112397
Pillow: Out-of-bounds access in _imagingmorph on a zero-widt -
CVE-2026-76788
Stack out-of-bounds write in the OSDP Control Panel reply pa -
CVE-2026-110680
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl wri
V. Comments for CVE-2026-33721
No comments yet