CVE-2026-55211

Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untrusted files are parsed. The severity assumes surfio is used to parse untrusted files in a networking context such as a web service. This issue is fixed in version 0.0.19.

• CWE-125

• https://github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa
• https://github.com/equinor/surfio/commit/e009c0cad145484f854aeb22d1979f9216b291db
• https://github.com/equinor/surfio/pull/86
• https://github.com/equinor/surfio/releases/tag/0.0.19
• https://github.com/equinor/surfio/security/advisories/GHSA-rcr2-hggw-43wm

Published

Sep 15, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55205Hermes WebUI before 0.51.468 contains a resource exhaustion …5.3
• CVE-2026-55206py7zr is a Python-based library and utility to support 7zip …8.7
• CVE-2026-55207Pimcore is an Open Source Data & Experience Management Platf…8.8
• CVE-2026-55208Pimcore Studio Backend Bundle is the backend bundle for Pimc…7.7
• CVE-2026-55209resdata is software for reading and writing result files fro…9.8
• CVE-2026-55210Joplin is an open source note-taking and to-do application t…7.4
• CVE-2026-55212Pimcore is an Open Source Data & Experience Management Platf…7.1
• CVE-2026-55213h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2026-55214GLPI is a free asset and IT management software package. Fro…8.5
• CVE-2026-55215MariaDB Connector/Node.js is used to connect applications de…7.5
• CVE-2026-55217GLPI is a free asset and IT management software package. Fro…5.3
• CVE-2026-55219Paymenter is a free and open-source webshop solution for man…5.3