CVE-2026-55211: surfio has an out-of-bounds read

August 18, 2026

Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.

References

github.com/advisories/GHSA-rcr2-hggw-43wm
github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa
github.com/equinor/surfio/pull/86
github.com/equinor/surfio/releases/tag/0.0.19
github.com/equinor/surfio/security/advisories/GHSA-rcr2-hggw-43wm
nvd.nist.gov/vuln/detail/CVE-2026-55211

Code Behaviors & Features

Detect and mitigate CVE-2026-55211 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →