Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-35001— OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow

Quick assessment

Affected
OpenS100 Project OpenS100
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenS100 直至提交版本 daa35b 中，S-102 海图表面（Bathymetric Surface）解析器存在整数溢出漏洞。攻击者可通过构造具有恶意网格维度元数据的 S-102 HDF5 文件，触发堆溢出，从而造成远程攻击者实现任意代码执行或导致应用程序崩溃。 具体而言，在 函数中，未经验证地直接对 （纬度方向点数）和 （经度方向点数）进行乘法运算，会导致 32 位整数溢出回绕（wraparound），进而导致堆缓冲区分配大小不足。随后发生的越界写操作可被攻击者利用，最终引发应用程序崩溃或任意代码执行。

CVSS 7.8 · High EPSS 0.20% · P10

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenS100 Project OpenS100 ≤ daaa35b19b789aa4b170bdcc300763a287d73164 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-35001

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
OpenS100 through commit daa35b contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. Attackers can exploit the unvalidated multiplication of numPointsLatitudinal and numPointsLongitudinal values in the S102_VG_BathymetryCoverage::Read() function to trigger a 32-bit integer wraparound, resulting in undersized heap buffer allocation and subsequent out-of-bounds writes that lead to application crash or arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenS100 Project OpenS100 0 ~ daaa35b19b789aa4b170bdcc300763a287d73164 -

II. Public POCs for CVE-2026-35001

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-35001

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-35001 (1)

News Coverage for CVE-2026-35001 (1)

IV. Related Vulnerabilities

Same product: OpenS100
Same vendor: OpenS100 Project
Same weakness: CWE-190

V. Comments for CVE-2026-35001

No comments yet

Leave a comment