CVE-2026-55211

Surfio, an open-source library for reading and writing surface files, fails to correctly validate size fields in IRAP-format files, resulting in an out-of-bounds memory access (buffer overflow) during parsing. An attacker triggers the flaw by supplying a crafted IRAP file to any application or service that uses an affected surfio version to parse untrusted input. The critical CVSS 9.8 rating assumes the library is exposed in a network context, such as a web service accepting uploaded surface files, where the flaw could lead to a crash or potential memory disclosure or code execution; local, trusted-file usage carries lower practical risk. All users of surfio versions prior to 0.0.19 are affected, with the fix available in version 0.0.19. There is no known public proof of concept and no evidence of in-the-wild exploitation.

What to do: Upgrade surfio to version 0.0.19 or later as the primary fix. If upgrading is not immediately possible, stop parsing IRAP files from untrusted sources and restrict file-upload endpoints that feed surfio to authenticated, vetted inputs. Operators of web services built on surfio should review logs for anomalous or malformed surface-file submissions and consider running the parser in a sandboxed process.