CVE-2026-50126 in adaguc-server
Summary
by MITRE • 08/18/2026
Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry contains a malformed coordinate. The coordinate parser in `adagucserverEC/CConvertGeoJSON.cpp` indexes `pt.u.array.values[0]` and `pt.u.array.values[1]` and uses `polygon.u.array.length` as a loop bound without first validating the JSON node type or the coordinate length. A coordinate that is an empty array, a one-element array, a scalar, or `null` leads to an out-of-bounds heap read or a NULL pointer dereference. The same unchecked pattern is present in four geometry branches: `Polygon`, `LineString`, `MultiLineString` and `MultiPolygon`. The vulnerable parser runs whenever the server processes a local GeoJSON file, either a configured GeoJSON dataset or a GeoJSON file exposed through the `AutoResource` feature and requested by an unauthenticated WMS request. A crafted GeoJSON file reliably crashes the backend process that handles that request. Version 7.2.2 patches the vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
Adaguc-server is an open-source geographical information system designed to visualize, combine, compare, and share real-time meteorological, climatological, and remote sensing data through OGC standards such as WMS and WCS. The software relies heavily on parsing external geographic data formats, particularly GeoJSON, which serves as a common interchange format for geospatial features. In versions prior to 7.2.2, the server contains critical memory-safety vulnerabilities within its JSON parsing logic that can be exploited by attackers to cause denial of service conditions or potentially achieve arbitrary code execution through heap corruption techniques. These flaws stem from insufficient validation of input data structures before accessing specific array indices and lengths, violating fundamental principles of secure coding regarding boundary checks and type safety.
The technical root cause lies in the file `adagucserverEC/CConvertGeoJSON.cpp`, where the coordinate parser fails to validate the JSON node type or verify that the coordinate array contains sufficient elements before attempting access. Specifically, the code indexes into `pt.u.array.values[0]` and `pt.u.array.values[1]` while using `polygon.u.array.length` as a loop bound without ensuring these values correspond to valid memory locations. When a GeoJSON document is submitted with malformed geometry data—such as an empty array, a single-element array, a scalar value instead of an array, or null—the parser proceeds to dereference invalid pointers or read out-of-bounds heap memory. This lack of defensive programming allows crafted inputs to trigger undefined behavior in the C++ runtime environment, leading directly to application crashes via NULL pointer dereferences or segmentation faults caused by accessing unmapped memory pages.
The vulnerability affects multiple geometry types within the GeoJSON specification, including Polygon, LineString, MultiLineString, and MultiPolygon. Each of these four branches exhibits the same unchecked pattern where coordinate arrays are accessed without prior validation of their existence or size. This systemic issue means that an attacker does not need to target a specific feature type; any request involving malformed geometry data across these supported types can trigger the flaw. The vulnerability is particularly severe because it resides in code paths executed during standard operational workflows, specifically when processing local GeoJSON files configured as datasets or those exposed through the AutoResource feature via WMS requests.
From an operational perspective, this vulnerability enables unauthenticated attackers to crash the backend process handling the request with high reliability. Since Adaguc-server is often deployed in public-facing environments to provide geospatial data services, the ability to remotely trigger a denial of service without authentication represents a significant risk to availability and continuity of operations. The consistent crashing of the server process disrupts access for legitimate users and may require manual intervention or restart procedures to restore functionality. In more complex exploitation scenarios involving heap-based buffer overflows resulting from out-of-bounds reads, there is potential for memory corruption that could be leveraged further by sophisticated attackers to execute arbitrary code on the underlying system, although immediate impact manifests as service disruption.
This vulnerability aligns with CWE-125 Out-of-bounds Read and CWE-476 NULL Pointer Dereference under Common Weakness Enumeration standards. It also maps to MITRE ATT&CK technique T1498 Network Denial of Service, specifically subtechnique 1498.001 Direct Network Flood if considered as a resource exhaustion vector, though primarily it constitutes a direct application crash vulnerability. The lack of input validation reflects CWE-20 Improper Input Validation and CWE-754 Improper Check for Unusual or Exceptional Conditions, highlighting the necessity for robust error handling in security-critical parsing routines.
Mitigation strategies focus on immediate patching and defensive configuration changes. Organizations running Adaguc-server must upgrade to version 7.2.2 or later where these memory safety issues have been resolved through proper validation of JSON node types and coordinate array lengths before access. Until patches are applied, administrators should restrict network exposure by placing the server behind a Web Application Firewall capable of inspecting GeoJSON payloads for malformed structures or restricting AutoResource features to authenticated users only. Additionally implementing strict input sanitization at the proxy level can help filter out maliciously crafted requests containing empty arrays, scalars, or null values in geometry fields before they reach the vulnerable parser logic. Regular security audits and static analysis tools should be employed to detect similar patterns of unchecked array access in other parts of the codebase to prevent future occurrences of this class of vulnerability.