CVE-2026-45104highCWE-129CWE-476

CVE-2026-45104: falha de alta gravidade em MapServer

MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar MapServer+ Monitorar mapserver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.3%
MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
MapServer · MapServer
CVEs relacionadas — MapServer

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33721MEDIUMMapServer has heap buffer overflow in SLD `Categorize` Threshold parsingEPSS 1.2%CVE-2026-54354HIGHMapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query TranslationEPSS 0.7%CVE-2026-54355MEDIUMMapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`EPSS 0.5%CVE-2025-59431HIGHMapServer - WFS XML Filter Query SQL injectionEPSS 0.4%CVE-2026-42030MEDIUMMapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerEPSS 0.2%