CVE-2026-55211: surfio has an out-of-bounds read

August 18, 2026

Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.

References

github.com/advisories/GHSA-rcr2-hggw-43wm
github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa
github.com/equinor/surfio/pull/86
github.com/equinor/surfio/releases/tag/0.0.19
github.com/equinor/surfio/security/advisories/GHSA-rcr2-hggw-43wm
nvd.nist.gov/vuln/detail/CVE-2026-55211

Code Behaviors & Features

Detect and mitigate CVE-2026-55211 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →