{"id":"CVE-2026-111158","summary":"EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect","details":"EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.","modified":"2026-10-17T07:04:56.131994695Z","published":"2026-10-15T18:57:46.924Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111158.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111158.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111158"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/earthscope-libmseed-through-3.5.4-heap-out-of-bounds-read-via-ms3-detect"},{"type":"FIX","url":"https://github.com/EarthScope/libmseed/commit/c93a36a1381e944b59b10967342ee1cb94304223"},{"type":"PACKAGE","url":"https://github.com/EarthScope/libmseed"},{"type":"ARTICLE","url":"https://github.com/EarthScope/libmseed/blob/d6e6ad306de5b7bdde072e5a5e3d58ddcc11abd8/parseutils.c#L192-L234"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/libmseed-ms3detect-short-header-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/earthscope/libmseed","events":[{"introduced":"0"},{"fixed":"d6e6ad306de5b7bdde072e5a5e3d58ddcc11abd8"},{"fixed":"c93a36a1381e944b59b10967342ee1cb94304223"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.5.4"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v3.5.3","v3.5.2","v3.5.1","v3.5.0","v3.4.1","v3.4.0","v3.3.0","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.11","v3.1.10","v3.1.9","v3.1.8","v3.1.7","v3.1.6","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.18","v3.0.17","v3.0.16","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.19.5","v2.19.4","v2.19.3","v2.19.2","v2.18","v2.17","v2.16m","v2.16","v2.15","v2.14","v2.13","v2.12","v2.11","v2.10","v2.9","v2.8","v2.7","v2.6.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111158.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["202011214084254834437125698954303681635","219796611571551498578618748936052862159","207306513494648085793220672822583571273","91707536175915248757279208255895728400"],"threshold":0.9},"id":"CVE-2026-111158-875f38c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/earthscope/libmseed/commit/c93a36a1381e944b59b10967342ee1cb94304223","target":{"file":"parseutils.c"}},{"id":"CVE-2026-111158-ebeefe21","signature_type":"Function","signature_version":"v1","source":"https://github.com/earthscope/libmseed/commit/c93a36a1381e944b59b10967342ee1cb94304223","target":{"file":"parseutils.c","function":"ms3_detect"},"deprecated":false,"digest":{"function_hash":"289706778384830332843013230905572198614","length":1759}}],"vanir_signatures_modified":"2026-10-17T07:04:56Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}