CVE-2026-35001 OpenS100 Project CVE debrief

Who should care

Defenders responsible for OpenS100 deployments should assess exposure and prioritize remediation. System administrators and security teams handling GIS or bathymetric data should verify their inventory and review OpenS100 configurations.

Why it matters

CVE-2026-35001 is a high-severity vulnerability in OpenS100's S-102 Bathymetric Surface parser. Defenders should prioritize verification of OpenS100 versions, restrict access to untrusted S-102 HDF5 files, and implement input validation to mitigate potential application crashes or code execution.

• Potential application crash or arbitrary code execution
• Verification of OpenS100 version and exposure to crafted S-102 HDF5 files
• Restrict access to S-102 HDF5 files from untrusted sources
• Implement input validation and sanitization for grid dimension metadata

Technical summary

The OpenS100 S-102 Parser contains an integer overflow vulnerability that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. The vulnerability is caused by the unvalidated multiplication of numPointsLatitudinal and numPointsLongitudinal values in the S102_VG_BathymetryCoverage::Read() function, which can trigger a 32-bit integer wraparound, resulting in undersized heap buffer allocation and subsequent out-of-bounds writes.

Defensive priority

High

Recommended defensive actions

• Review and update OpenS100 to a version beyond the affected commit daa35b
• Restrict access to S-102 HDF5 files from untrusted sources
• Implement input validation and sanitization for grid dimension metadata
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on an integer overflow vulnerability in OpenS100's S-102 Bathymetric Surface parser. The vulnerability allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.