CVE-2026-55211: surfio Out-of-Bounds Read (CWE-125)

// Detect vulnerable surfio installs and untrusted surface-file ingestion by Python
let vulnFixed = "0.0.19";
union isfuzzy=true
(
  DeviceProcessEvents
  | where FileName in~ ("python.exe","python3","python3.exe","python")
  | where ProcessCommandLine has "surfio" or ProcessCommandLine has_any (".irap",".gri","surface")
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, EventType="process"
),
(
  DeviceFileEvents
  | where FolderPath has_any ("site-packages\\surfio","site-packages/surfio","/surfio/")
  | where FileName endswith "__init__.py" or FileName endswith ".dist-info"
  | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName, EventType="install"
)
| order by Timestamp desc

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=linux:audit OR sourcetype=osquery:results)
| eval proc=coalesce(process_name, Image, process)
| where like(lower(proc),"%python%")
| eval cmd=coalesce(process, CommandLine, cmdline)
| where match(lower(cmd),"surfio|\.irap|\.gri|surface")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(cmd) as commands by host, user, proc
| where count > 0

process where process.name : ("python","python3","python.exe") and
  (process.command_line : "*surfio*" or process.command_line : ("*.irap*","*.gri*","*surface*"))

SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Command Line" AS cmd, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOWER("Process Name") LIKE '%python%'
  AND (LOWER("Command Line") LIKE '%surfio%' OR LOWER("Command Line") LIKE '%.irap%' OR LOWER("Command Line") LIKE '%.gri%' OR LOWER("Command Line") LIKE '%surface%')
ORDER BY devicetime DESC LAST 7 DAYS

_sourceCategory=*endpoint* OR _sourceCategory=*sysmon*
| where tolowercase(process_name) matches "*python*"
| where tolowercase(command_line) matches /surfio|\.irap|\.gri|surface/
| count by host, user, process_name, command_line
| sort by _count desc

rule surfio_oob_read_CVE_2026_55211 {
  meta:
    author = "Argus"
    description = "Detects Python processes referencing surfio or Irap surface files (CVE-2026-55211 OOB read)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.file.full_path, `(?i)python`)
    re.regex($e.target.process.command_line, `(?i)(surfio|\.irap|\.gri|surface)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName=/python/i
| CommandLine=/(?i)(surfio|\.irap|\.gri|surface)/
| groupBy([ComputerName, UserName, ImageFileName], function=collect([CommandLine]))