GitHub Advisoryadvisory · PyPI

GHSA-rcr2-hggw-43wm surfio has an out-of-bounds read

CRITICAL Published 2026-08-18 Modified 2026-08-18 Official page ↗
Aliases
CVE-2026-55211
Ecosystem
PyPI
Packages
surfio
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-125
Reviewed
2026-08-18

Affected packages

• PyPI surfio: < 0.0.19 → fixed in 0.0.19

Description

Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service. Patches The bug has been patched in version 0.0.19

Related

Alias · CVE (1)

  • CVE-2026-55211 Surfio is a library for reading and writing surface files. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References