CVE-2026-110661 in CGNS
Summary
by MITRE • 10/14/2026
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The Common Generic Numerical System library, specifically versions up through 4.5.2, contains a critical stack-based out-of-bounds read vulnerability located within the ADFI_read_node_header function. This flaw arises from improper boundary checking when parsing node headers in Advanced Data Format files, which are commonly used to store complex scientific and engineering data structures. The vulnerability is triggered when an attacker supplies crafted .cgns or .adf files that contain malformed metadata, specifically where end tags within the file structure lack proper null-termination characters. This deviation from expected formatting causes the internal string indexing function ADFI_stridx_c to perform memory reads beyond the allocated stack buffer boundaries defined by disk_node_data.
From a technical perspective, this vulnerability represents a classic instance of an out-of-bounds read condition where the application fails to validate the length or termination status of input strings before processing them. When the parser encounters a non-NUL-terminated end tag, it continues scanning memory sequentially until it either finds a null byte elsewhere in memory or accesses protected regions outside the designated buffer space. This behavior leads directly to an out-of-bounds read operation that corrupts the stack state and typically results in immediate application termination via segmentation fault or access violation errors. Tools such as cgnslist, which are designed to list contents of CGNS files, are particularly susceptible because they frequently parse node headers during initialization phases without sufficient defensive programming practices regarding input validation.
The operational impact of this vulnerability is primarily denial of service against applications that rely on the CGNS library for file ingestion. While the immediate effect manifests as a crash or termination of the host application, out-of-bounds reads can potentially expose sensitive information residing in adjacent memory locations if the attacker can control subsequent read operations or leverage the corrupted state for further exploitation attempts. Although no direct code execution is explicitly detailed in this specific vector, such memory corruption issues often serve as precursors to more severe exploits involving arbitrary read capabilities that could leak cryptographic keys, session tokens, or other confidential data stored within the application's address space.
This vulnerability aligns with CWE-125, which describes out-of-bounds read conditions resulting from insufficient validation of array indices or buffer lengths during input processing. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1083, specifically under file and directory discovery mechanisms where malformed inputs are used to disrupt system availability rather than establish persistence. The lack of proper bounds checking in the ADFI_read_node_header function highlights a gap in secure coding practices related to handling untrusted external data sources that define structural metadata for binary or semi-binary formats.
Mitigation strategies should focus on immediate patching by upgrading the CGNS library to version 4.5.3 or later, where this boundary check issue has been addressed through enhanced input validation routines. Developers integrating CGNS into their applications must ensure they are using patched versions and consider implementing additional sanity checks at the application layer before passing file contents to the library functions. For organizations unable to upgrade immediately, deploying network-level intrusion detection signatures that identify malformed ADF node headers or restricting access to untrusted .cgns and .adf files can reduce exposure risk until a permanent fix is deployed in production environments.