CVE-2026-35001 in OpenS100
Summary
by MITRE • 10/13/2026
OpenS100 through commit daa35b contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. Attackers can exploit the unvalidated multiplication of numPointsLatitudinal and numPointsLongitudinal values in the S102_VG_BathymetryCoverage::Read() function to trigger a 32-bit integer wraparound, resulting in undersized heap buffer allocation and subsequent out-of-bounds writes that lead to application crash or arbitrary code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within OpenS100 versions up to commit daa35b represents a critical security flaw located specifically within the S-102 Bathymetric Surface parser component of the software suite. This module is responsible for processing Hydrographic Data Exchange files, particularly those adhering to the IHO S-102 standard which utilizes HDF5 as its container format. The core technical deficiency stems from a failure in input validation and arithmetic safety checks during the parsing process. Specifically, when the application processes an S-102 file containing bathymetric coverage data, it attempts to allocate memory for grid points based on metadata fields labeled numPointsLatitudinal and numPointsLongitudinal. The code performs a multiplication of these two integer values to determine the total number of elements required for the buffer allocation. However, this operation is conducted using 32-bit signed integers without any prior bounds checking or overflow detection mechanisms.
This lack of validation allows an attacker to craft a malicious S-102 HDF5 file where the product of numPointsLatitudinal and numPointsLongitudinal exceeds the maximum value representable by a 32-bit integer, which is two billion one hundred forty-seven million four hundred eighty-three thousand six hundred forty-seven. When this multiplication occurs, it triggers an integer wraparound or overflow condition. Instead of allocating memory for the large number of points implied by the metadata, the application allocates a significantly smaller buffer based on the truncated result of the overflowed calculation. This discrepancy between the expected data size and the actual allocated memory creates a classic heap-based buffer overflow scenario. As the parser proceeds to read the grid data into this undersized buffer, it writes beyond the allocated boundaries, corrupting adjacent heap metadata or application state structures.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via crafted input files. An attacker can distribute a malicious S-102 file through various channels such as email attachments, shared network drives, or compromised data repositories. When a victim opens the file using the vulnerable version of OpenS100, the application crashes immediately in most cases due to memory corruption detected by operating system protections like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). However, with precise exploitation techniques involving heap grooming and specific payload construction, an attacker can achieve arbitrary code execution on the target machine. This effectively allows full compromise of the host system running the hydrographic analysis software, potentially leading to unauthorized access to sensitive maritime data or further lateral movement within a network environment.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write in the Common Weakness Enumeration database. In terms of attack vectors, it falls under ATT&CK technique T1203 Exploitation for Client Execution, as it relies on tricking a user into opening a malicious file to trigger code execution. The vulnerability highlights the critical importance of rigorous input validation and safe arithmetic operations in software that processes external data formats, particularly those used in professional engineering and scientific applications where large datasets are common.
To mitigate this risk, immediate action is required by upgrading OpenS100 to a version released after commit daa35b which includes patches for the S-102 parser. Developers should implement explicit checks before performing multiplications involving user-controlled or file-derived integers to ensure that the result does not exceed predefined limits appropriate for memory allocation. Additionally, employing static analysis tools and fuzzing techniques during the software development lifecycle can help identify similar integer overflow vulnerabilities in other modules of the application suite. Organizations relying on this software should also enforce strict policies regarding the opening of files from untrusted sources until all systems are updated to secure versions.