GHSA Advisory: Critical resdata Flaws Enable Buffer Overflow and NULL Pointer Dereference via Malicious GRDECL Files

A GitHub Security Advisory published today discloses multiple memory-safety vulnerabilities in resdata, a Python package (equinor/resdata), tracked as CVE-2026-55209 with a CVSS score of 9.8. A public proof-of-concept is reportedly available.

What Happened

According to the advisory, versions of resdata prior to 6.2.9 fail to correctly validate input when parsing GRDECL files (a reservoir simulation grid data format). The advisory groups several distinct weaknesses together: a classic buffer overflow, improper validation of an array index, a NULL pointer dereference, and an out-of-bounds read. The maintainers note the high severity rating assumes resdata is used to parse untrusted files in a networking context, such as a web service. A patch is available starting in version 6.2.9.

Why It Matters for Defenders

resdata is used in oil-and-gas / reservoir engineering data pipelines to process GRDECL grid files. Any service or application that accepts GRDECL input from external or untrusted sources — for example a file-upload or conversion web service built on this library — could be exposed to memory-corruption issues that, per the advisory's severity assumptions, may lead to crashes (denial of service) or, depending on exploitability of the buffer overflow, potentially further compromise. Because a PoC is already public, the window between disclosure and opportunistic exploitation attempts is short.

What Defenders Should Watch For

• Inventory whether resdata (or any Python service depending on it) is present in your environment, particularly in any internet-facing or file-upload-accepting service.
• Prioritize upgrading to resdata 6.2.9 or later.
• Where upgrading is not immediately possible, avoid parsing GRDECL files from untrusted or external sources, or isolate the parsing step (sandboxing/containerization, resource limits) to limit blast radius from crashes or memory corruption.
• Monitor application logs and crash reports for unexpected process terminations or segfaults in services that ingest GRDECL files, as a potential indicator of exploitation attempts.
• Treat any file-format parser handling untrusted input as a high-value hardening target generally, not just this one library.

Developing Intel

This is a same-day advisory and details may evolve as the community assesses real-world exploitability and exposure. For the authoritative technical details and patch information, see the original GitHub Security Advisory: GHSA-pr85-w493-9w3x.