CVE-2026-55211: surfio out-of-bounds read in irap file parsing

Executive brief

surfio is a Python library for parsing irap (seismic data) files. Prior to version 0.0.19, the library fails to properly validate size fields in irap files, allowing an attacker to read beyond allocated memory boundaries. When surfio is used to process untrusted files—such as in a web service context—an attacker can exploit this to extract sensitive data, corrupt the application state, or trigger a denial of service.

Technical details

This is an out-of-bounds read vulnerability (CWE-125) in surfio's irap file parser. The root cause is improper validation of size fields within irap file structures, allowing an attacker-controlled input to trigger a read past the end of an allocated buffer. The vulnerability is exploitable over the network when surfio is deployed to process untrusted files (e.g., in a web service), with no authentication or user interaction required. An attacker can craft a malicious irap file that, when parsed, causes the library to read arbitrary memory, potentially leaking sensitive information, corrupting program state, or causing a crash (denial of service). The vulnerability has been patched in version 0.0.19, with the fix available in commit 1619750 and corresponding release on GitHub.

Affected products

• Equinor surfio < 0.0.19

Timeline

• 2026-06-11: disclosed: Published to GitHub Advisory Database
• 2026-08-18: patched: Version 0.0.19 released with fix

References

• https://api.github.com/users/oddmunds
• https://github.com/oddmunds
• https://api.github.com/users/oddmunds/gists%7B/gist_id%7D
• https://api.github.com/users/oddmunds/repos
• https://avatars.githubusercontent.com/u/111420045?v=4
• https://api.github.com/users/oddmunds/events%7B/privacy%7D