CVE-2026-111158 in libmseed
Summary
by MITRE • 10/15/2026
EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in EarthScope libmseed versions through 3.5.4 represents a critical memory safety flaw located within the core parsing logic of the library, specifically inside the ms3_detect function found in parseutils.c. This heap-based out-of-bounds read occurs when the software attempts to validate or process miniSEED version 2 data records that have been truncated or are otherwise malformed. The root cause lies in an insufficient boundary check during the header validation phase, where the code assumes a minimum record size that is not strictly enforced against the actual length of the input buffer provided by the caller. This design oversight allows for memory access beyond the allocated heap region when processing data streams that do not conform to expected structural integrity standards.
From a technical perspective, the flaw manifests when an attacker supplies a crafted miniSEED 2 record with a size ranging from forty to forty-seven bytes. The library's internal function msr3_parse or its detection counterpart ms3_detect invokes the MS2_ISVALIDHEADER macro to verify the integrity of the incoming data stream. Because this validation routine does not adequately account for buffers that are shorter than the full expected header structure, it proceeds to read memory locations adjacent to the end of the provided buffer. This results in an over-read condition where up to eight bytes of uninitialized or unrelated heap memory are accessed. Such behavior is characteristic of CWE-125, which defines out-of-bounds read vulnerabilities that occur when software reads data past the intended boundary of a buffer, potentially exposing sensitive information or causing instability within the application environment.
The operational impact of this vulnerability centers on the potential for denial of service through process termination. When the library attempts to access memory addresses outside its allocated heap space, it triggers an illegal memory access exception, typically resulting in a segmentation fault that crashes the hosting application. In environments where libmseed is used for continuous seismic data ingestion or real-time monitoring systems, such abrupt terminations can lead to significant service interruptions and loss of critical observational data. While the primary impact observed is stability-related rather than direct code execution, out-of-bounds reads can sometimes leak internal state information depending on what resides in the adjacent memory regions, thereby introducing secondary confidentiality risks that extend beyond simple availability degradation.
This vulnerability aligns with ATT&CK technique T1059, specifically sub-techniques related to command and script interpreters or system utilities if exploited within a larger pipeline, though its immediate classification is more accurately tied to exploitation of input validation flaws leading to resource exhaustion via crash. Mitigation strategies should prioritize upgrading libmseed to version 3.5.4 or later where this specific boundary check has been corrected by the maintainers. For systems that cannot immediately upgrade, implementing strict buffer length verification at the application layer before passing data to the library is essential. Developers must ensure that any incoming miniSEED records are validated for minimum size requirements consistent with the MS2 header specification prior to invocation of parsing functions. Additionally, employing memory-safe programming practices and utilizing static analysis tools capable of detecting out-of-bounds reads can help identify similar flaws in custom implementations or wrapper code surrounding this library.