CVE-2026-55209: Equinor resdata input validation flaws in GRDECL parsing

Executive brief

Equinor's resdata is a library that parses GRDECL files, a common format for reservoir simulation data. Versions prior to 6.2.9 fail to properly validate input data, allowing attackers to trigger buffer overflows, NULL pointer dereferences, and out-of-bounds reads by supplying malicious GRDECL files. When exposed to untrusted input—such as in a web service—an attacker can crash the application or potentially execute arbitrary code.

Technical details

resdata contains multiple input validation flaws when parsing GRDECL files, including classic buffer overflow (CWE-120), improper array index validation (CWE-129), out-of-bounds reads (CWE-125), and NULL pointer dereferences (CWE-476). The vulnerability exists in the file parser and is exploitable remotely over the network with no authentication or user interaction required. An attacker can craft a malicious GRDECL file and supply it to an application or web service using resdata for parsing, triggering memory corruption, application crash, or potentially arbitrary code execution. The vulnerability has been patched starting with version 6.2.9. Users should upgrade immediately, especially if resdata is used in any networked or untrusted-input scenario.

Affected products

• Equinor resdata < 6.2.9

Timeline

• 2026-06-11: disclosed: GitHub advisory published
• 2026-06-11: patched: Version 6.2.9 released with fix
• 2026-08-18: advisory: Updated in GitHub Advisory Database

References

• https://api.github.com/users/oddmunds
• https://github.com/oddmunds
• https://api.github.com/users/oddmunds/gists%7B/gist_id%7D
• https://api.github.com/users/oddmunds/repos
• https://avatars.githubusercontent.com/u/111420045?v=4
• https://api.github.com/users/oddmunds/events%7B/privacy%7D