CVE-2026-55211 IBM QRadar · QRadar

Detect CVE-2026-55211: surfio Out-of-Bounds Read (CWE-125) in IBM QRadar

Detects exploitation and exposure of CVE-2026-55211, an out-of-bounds read (CWE-125) in the Python 'surfio' package (Equinor) affecting versions < 0.0.19. surfio parses Irap surface grid files; a maliciously crafted surface file can trigger a read beyond allocated buffer bounds, leading to information disclosure or a denial-of-service crash in Python services that ingest untrusted surface data. With CVSS 9.8 and a public PoC, detection focuses on identifying vulnerable installations, ingestion of untrusted surface files by Python processes importing surfio, and abnormal crashes/segfaults of processes loading the library.

MITRE ATT&CK

Tactic
Initial Access Impact

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Command Line" AS cmd, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOWER("Process Name") LIKE '%python%'
  AND (LOWER("Command Line") LIKE '%surfio%' OR LOWER("Command Line") LIKE '%.irap%' OR LOWER("Command Line") LIKE '%.gri%' OR LOWER("Command Line") LIKE '%surface%')
ORDER BY devicetime DESC LAST 7 DAYS
critical severity medium confidence

AQL query returning Python process events referencing surfio or Irap surface files, to identify vulnerable ingestion of untrusted surface data.

Data Sources

SysmonLinux auditd via QRadar DSM

Required Tables

events

False Positives & Tuning

  • Trusted surface-processing applications using surfio
  • Package management upgrading surfio
  • Interactive data-science usage on vetted files

Other platforms for CVE-2026-55211

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Inventory vulnerable surfio version

    Expected signal: Process execution of python3/pip with 'surfio' on the command line; file creation under site-packages/surfio

  2. Test 2Simulate untrusted surface-file ingestion

    Expected signal: Python process command line referencing 'surfio' and a '.irap' file path

  3. Test 3Detect surfio import on Windows host

    Expected signal: DeviceProcessEvents record for python.exe with 'surfio' in ProcessCommandLine

Last updated: 2026-08-26 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm whether the host has surfio installed and at what version: run `pip show surfio` (or inspect site-packages). Any version < 0.0.19 is vulnerable to CVE-2026-55211.
  2. Identify the process/service that imported surfio and determine whether it parses surface files (.irap/.gri) sourced from untrusted or external input.
  3. Review the specific surface file(s) processed around the alert time — capture file path, origin, and hash; untrusted-origin files parsed by a vulnerable surfio are the exploitation vector.
  4. Check for process crashes, segmentation faults, or abnormal memory-read behavior of the Python process coinciding with the ingestion event.

Containment

  1. Upgrade surfio to 0.0.19 or later on all affected hosts (`pip install --upgrade 'surfio>=0.0.19'`), or pin the fixed version in dependency manifests.
  2. Until patched, quarantine or block ingestion of externally-sourced surface files into services using surfio, and isolate any host actively processing suspect files.

Evidence Collection

  1. Preserve the suspect surface file(s), the surfio package version metadata (dist-info), and the process command line and environment.
  2. Collect process memory dumps and stderr/crash logs from the Python process at time of the OOB read for forensic analysis and to distinguish crash vs. information disclosure.

Escalation Criteria

  • !Escalate to IR if a vulnerable surfio parsed an untrusted/external surface file AND the process crashed or exhibited anomalous memory access, indicating active exploitation.
  • !Escalate to the application/asset owner if a public-facing or automated service ingesting untrusted data runs surfio < 0.0.19, given CVSS 9.8 and a public PoC.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >The malicious/malformed surface file (.irap/.gri) that was parsed
  • >surfio package version and dist-info metadata under site-packages
  • >Python process crash logs, core dumps, and stderr traces referencing surfio parsing routines

Tuning Guidance

Baseline the set of hosts and service accounts that legitimately run surfio against trusted internal surface data, and exclude those command lines/paths. Focus alerting on surfio invocations that parse files from untrusted origins (uploads, external shares, network sources) or that coincide with process crashes. Once all hosts are confirmed at surfio >= 0.0.19, downgrade the exposure query to periodic inventory rather than real-time alerting.

Hunting Queries

Locate all hosts with a surfio installation so vulnerable versions (< 0.0.19) can be inventoried and prioritized for patching.

Hunting — KQL
kql 
DeviceFileEvents | where FolderPath has "surfio" and (FileName endswith ".dist-info" or FileName endswith "__init__.py") | project Timestamp, DeviceName, FolderPath, FileName
Hunting — SPL
spl 
index=* sourcetype=osquery:results (path="*site-packages/surfio*") | stats values(path) by host

Atomic Red Team Tests

Test 1 Inventory vulnerable surfio version
linux

Detects presence of a vulnerable surfio installation by querying the installed package version.

Command

bash 
pip install 'surfio==0.0.18' 2>/dev/null; python3 -c "import surfio, importlib.metadata as m; print('surfio', m.version('surfio'))"

Cleanup

bash 
pip uninstall -y surfio

Expected Telemetry

Process execution of python3/pip with 'surfio' on the command line; file creation under site-packages/surfio

Expected Detection

KQL/SPL exposure queries flag the surfio reference and the install file events identify the vulnerable version.

Test 2 Simulate untrusted surface-file ingestion
linux

Runs a Python snippet that imports surfio and attempts to parse a locally-staged surface file, emulating ingestion of untrusted data.

Command

bash 
python3 -c "import surfio; print('surfio loaded'); open('/tmp/test.irap','wb').write(b'\x00'*32)" ; python3 -c "import surfio" ; echo 'parsed /tmp/test.irap (lab)'

Cleanup

bash 
rm -f /tmp/test.irap

Expected Telemetry

Python process command line referencing 'surfio' and a '.irap' file path

Expected Detection

Process-event queries match the python + surfio/.irap command line.

Test 3 Detect surfio import on Windows host
windows

Executes a Python one-liner on Windows importing surfio to validate endpoint process telemetry and detection coverage.

Command

powershell 
python.exe -c "import surfio; print('surfio', surfio.__file__)"

Cleanup

powershell 
echo no cleanup required

Expected Telemetry

DeviceProcessEvents record for python.exe with 'surfio' in ProcessCommandLine

Expected Detection

KQL DeviceProcessEvents branch and CrowdStrike/Chronicle process rules match the surfio reference.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0040Impact

Related Techniques

T1203Exploitation for Client ExecutionT1499Endpoint Denial of Service

Same Tactic: Initial Access

Popular Detections