CVE-2026-55209resdata insufficiently validates untrusted GRDECL files
Updated under an hour ago ()
Does this affect you?
It affects equinor resdata. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-120, CWE-125, CWE-129, CWE-476
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
equinor resdata equinor:resdata (from the name) | before 6.2.9 | CNA record |
References
- https://github.com/equinor/resdata/security/advisories/GHSA-pr85-w493-9w3xx-refsource-confirm
- https://github.com/equinor/resdata/pull/1166x-refsource-misc
- https://github.com/equinor/resdata/commit/9f8fd6db472e0696080b768389914d60a453904fx-refsource-misc
- https://github.com/equinor/resdata/commit/d3f45828e9413506b8e8160a9304f4b7b06dcefcx-refsource-misc
- https://github.com/equinor/resdata/commit/ee8cc12b026d945df3077bc98e211ee45f80a433x-refsource-misc
- https://github.com/equinor/resdata/releases/tag/6.2.9x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.