Executive brief
OpenS100 is a reference software used for viewing maritime navigation charts. A vulnerability in its portrayal engine allows an attacker to execute malicious code on a user's computer if the user imports a specially crafted navigation chart or portrayal catalogue. This could lead to a full system compromise, data theft, or unauthorized control over the navigation software.
Technical details
The OpenS100 Portrayal Engine initializes its Lua interpreter using the luaL_openlibs() function without implementing any sandboxing or capability restrictions. This exposes dangerous standard libraries, including 'os', 'io', and 'debug', to untrusted portrayal catalogues. An attacker can exploit this by crafting a malicious S-100 portrayal catalogue containing Lua scripts that call these functions to perform arbitrary system commands. The vulnerability is triggered when a user imports the malicious catalogue and loads a chart, leading to remote code execution with the privileges of the OpenS100 process. The issue was addressed in commit 753cf29 by explicitly nullifying dangerous Lua functions and libraries after initialization.
Affected products
- S-100ExpertTeam OpenS100 (S-100 viewer) prior to commit 753cf29
Timeline
- 2026-02-13: patched: Security patch committed to GitHub repository.
- 2026-02-17: disclosed: Initial vulnerability disclosure.
- 2026-02-17: advisory