GHSA Advisory: Critical Out-of-Bounds Read in surfio (CVE-2026-55211, CVSS 9.8)

What Happened

A GitHub Security Advisory (GHSA-rcr2-hggw-43wm) discloses that surfio, a Python (pip) package, fails to correctly validate size fields when parsing IRAP files. According to the advisory, this leads to a buffer overflow / out-of-bounds read in versions prior to 0.0.19, tracked as CVE-2026-55211 with a CVSS score of 9.8. The advisory notes exploit code is publicly available (proof-of-concept). A fix is available in version 0.0.19.

Why It Matters

The advisory explicitly states the severity rating assumes surfio is used to parse untrusted files in a networking context, such as a web service. Any application that accepts IRAP-format files from external or untrusted sources and passes them to surfio for parsing is potentially exposed to memory-corruption issues — worth noting given surfio's use in geoscience/subsurface data workflows where file ingestion from external partners is common. With a public PoC in circulation, the window between disclosure and opportunistic exploitation attempts is short.

What Defenders Should Do Now

• Inventory whether surfio is present in your environment (directly or as a transitive dependency) — check pip manifests and lockfiles for versions prior to 0.0.19.
• Prioritize upgrading to 0.0.19 or later, especially on any service that parses IRAP files from external or untrusted sources.
• Where immediate patching isn't possible, restrict which sources can submit IRAP files to affected services, and consider sandboxing or isolating the parsing process.
• Hunt for anomalous crashes, segfaults, or unexpected process restarts in services that ingest IRAP files, which could indicate exploitation attempts against the overflow.
• Watch for unusual file uploads targeting IRAP-parsing endpoints as a precursor to exploitation attempts.

Developing Intel

This is a same-day advisory and details may evolve as the community assesses real-world exposure and exploitability. No confirmed in-the-wild exploitation or ransomware use has been reported at this time. For full technical details, see the original advisory: GHSA-rcr2-hggw-43wm.