ANT-2026-8QCK7K2C · osgeo/gdal

heap-buffer-overflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Sonnet 4.6

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-8QCK7K2C: This is a genuine heap-buffer-overflow vulnerability in GDAL's MiraMon raster format driver.

GDAL's MiraMon raster format driver performs an out-of-bounds heap WRITE when opening a crafted MiraMon file. The issue was surfaced through the gdal_miramon_fuzzer entrypoint and independently reproduced by two separate fuzzing configurations. An attacker able to supply a malicious MiraMon raster to any application or service that opens it with GDAL can corrupt heap memory, potentially leading to denial of service or further exploitation.

Target

Project: gdal
Commit: 5b29997363b13eec

Technical Details

ASAN reports a heap-buffer-overflow on a WRITE operation during MiraMon raster parsing, meaning the driver writes past the end of a heap-allocated buffer while processing attacker-controlled file contents. The specific overflowed buffer and root-cause arithmetic are not identified in the available metadata; see the attached crash_output.txt for the full ASAN report and stack frames.

Crash signature: ASAN heap-buffer-overflow WRITE in gdal_miramon_fuzzer

Reproduction

Craft a malformed MiraMon raster file matching the PoC structure
Cause the target (GIS server, conversion pipeline, desktop app) to open the file with GDAL
The MiraMon driver performs an out-of-bounds heap write during parsing

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-8QCK7K2C.

Reference: ANT-2026-8QCK7K2C
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict: true positive
Severity: high

UPSTREAM FIX

The change that resolved this finding.

diff --git a/frmts/miramon/miramon_palettes.cpp b/frmts/miramon/miramon_palettes.cpp
index 1f8f94d03bb6..61e25d0c79fa 100644
--- a/frmts/miramon/miramon_palettes.cpp
+++ b/frmts/miramon/miramon_palettes.cpp
@@ -486,6 +486,14 @@ MMRPalettes::GetPaletteColors_PAL_P25_P65(const CPLString &os_Color_Paleta_DBF)
         if (pszLine[0] == '\0')
             continue;
 
+        if (nNReadPaletteColors >= m_nNPaletteColors)
+        {
+            VSIFCloseL(fpColorTable);
+            CPLError(CE_Failure, CPLE_AppDefined, "Invalid color table: \"%s\"",
+                     osColorTableFileName.c_str());
+            return CE_Failure;
+        }
+
         const CPLStringList aosTokens(CSLTokenizeString2(pszLine, " \t", 0));
         if (aosTokens.size() != 4)
         {

https://github.com/OSGeo/gdal/commit/73e529799365da26d37d6039fca0c432f8ffa420

TIMELINE

Dates from discovery through public reveal.

2026-03-26 Reported to tracker
2026-05-12 Patch released
2026-05-13 Sent to maintainer
2026-05-13 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

1f93ea5d2b4db7a9f421f3cd9f9147bcee5c60a03b29e5d9a55584d5648bb9e0a7a9dbf4a948276db69dc251f39394cd7f577129da4332b3363cd7e2140f145f

Committed 2026-05-13 10:55 PT

Revealed 2026-08-17 16:08 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-8QCK7K2C",
  "bug_class": "heap-buffer-overflow",
  "claude_severity": "high",
  "commit_sha": "5b29997363b13eec",
  "created_at": "2026-03-27T01:47:30+00:00",
  "description": "GDAL's MiraMon raster format driver performs an out-of-bounds heap WRITE when opening a crafted MiraMon file. The issue was surfaced through the gdal_miramon_fuzzer entrypoint and independently reproduced by two separate fuzzing configurations. An attacker able to supply a malicious MiraMon raster to any application or service that opens it with GDAL can corrupt heap memory, potentially leading to denial of service or further exploitation.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "gdal",
  "reproduction": [
    "1. Craft a malformed MiraMon raster file matching the PoC structure",
    "2. Cause the target (GIS server, conversion pipeline, desktop app) to open the file with GDAL",
    "3. The MiraMon driver performs an out-of-bounds heap write during parsing"
  ],
  "technical_details": "ASAN reports a heap-buffer-overflow on a WRITE operation during MiraMon raster parsing, meaning the driver writes past the end of a heap-allocated buffer while processing attacker-controlled file contents. The specific overflowed buffer and root-cause arithmetic are not identified in the available metadata; see the attached crash_output.txt for the full ASAN report and stack frames.",
  "title": "This is a genuine heap-buffer-overflow vulnerability in GDAL's MiraMon raster format driver.",
  "vendor_severity": "high"
}