CVE-2026-45104: mapserver Improper Validation of Array Index
Vulnerability summary
CVE-2026-45104 is a high (CVSS 7.5) Improper Validation of Array Index vulnerability in mapserver. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-05-2026PublishedVulnerability first disclosed.
- 01-06-2026Last modifiedVulnerability information updated.
Description
MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.17 pp
From 0.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMapserver
Maturity: poc
Weaknesses
CWE · root cause- CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
Affected systems
Debian1 product
- mapserverAll versions (No fix recorded) | < 8.6.3-1
Mapserver1 product
- mapserver≥ 6.4.0, < 8.6.3
Osgeo1 product
- mapserver≥ 6.4.0, < 8.6.3
Ubuntu1 product
- mapserverAll versions (No fix recorded)
4 vendors · 4 products
References
4 links- github.com/MapServer/MapServer/security/advisories/GHSA-4h8g-378q-r75mX Refsource CONFIRMREPORTExploitMitigationVendor Advisory
