CVE-2026-55209

resdata, Equinor's open-source library for reading and writing Eclipse reservoir-simulator files, insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes when parsing GRDECL input in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. An unauthenticated attacker who can submit a crafted GRDECL file containing malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data, or oversized floating-point values that overflow the parser buffer, to a service built on resdata can trigger buffer overflows, out-of-bounds reads, NULL pointer dereferences, and memory corruption — potentially crashing the service or achieving code execution (CVSS 9.8: network vector, no privileges or user interaction required). The practical risk is limited to deployments where resdata parses untrusted GRDECL files, such as file-upload endpoints in reservoir-simulation or subsurface-data platforms; local CLI use on trusted files is not remotely exploitable. No public proof of concept or exploitation in the wild is known. The flaw is fixed in resdata version 6.2.9.

What to do: Upgrade resdata to version 6.2.9 or later wherever it is installed, including Python/conda environments and container images that embed it. Identify any internal services, upload endpoints, or job-submission pipelines that parse GRDECL files from untrusted users and treat them as potentially exposed until patched. If immediate upgrade is not possible, run resdata-based parsing in an isolated, least-privileged process and pre-validate COORD, ZCORN, CORSNUM, ACTNUM, and MAPAXES blocks for consistent lengths and well-formed numeric values before handing them to the library.