CVE-2026-33721
published 2026-03-27CVE-2026-33721: MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.86%
54.1th percentile
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mapserver | < mapserver 8.6.1-1 (forky) | mapserver 8.6.1-1 (forky) |
| mapserver | mapserver | — | — |
| osgeo | mapserver | >= 0 < 8.6.1-1 | 8.6.1-1 |
| osgeo | mapserver | >= 4.2.0 < 8.6.1 | 8.6.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-33721: MapServer is a system for developing web-based GIS applications
osv·2026-03-27·CVSS 7.5
CVE-2026-33721 [HIGH] CVE-2026-33721: MapServer is a system for developing web-based GIS applications
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
Red Hat
MapServer: MapServer: Denial of Service via crafted Styled Layer Descriptor
vendor_redhat·2026-03-27·CVSS 5.3
CVE-2026-33721 [MEDIUM] CWE-787 MapServer: MapServer: Denial of Service via crafted Styled Layer Descriptor
MapServer: MapServer: Denial of Service via crafted Styled Layer Descriptor
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
A flaw was found in MapServer, a system for developing web-based Geographic Information System (GIS) applications. A remote, unauthenticated attacker can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Styled Layer Descriptor (SLD) with an ex
Debian
CVE-2026-33721: mapserver - MapServer is a system for developing web-based GIS applications. Starting in ver...
vendor_debian·2026·CVSS 5.3
CVE-2026-33721 [MEDIUM] CVE-2026-33721: mapserver - MapServer is a system for developing web-based GIS applications. Starting in ver...
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 8.6.1-1)
sid: resolved (fixed in 8.6.1-1)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33721 mapserver: MapServer: Denial of Service via crafted Styled Layer Descriptor [fedora-all]
bugzilla·2026-03-27·CVSS 5.3
CVE-2026-33721 [MEDIUM] CVE-2026-33721 mapserver: MapServer: Denial of Service via crafted Styled Layer Descriptor [fedora-all]
CVE-2026-33721 mapserver: MapServer: Denial of Service via crafted Styled Layer Descriptor [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-b5a2da2c73 (mapserver-8.6.1-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b5a2da2c73
---
FEDORA-EPEL-2026-43ec22fd0e (mapserver-8.6.1-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-43ec22fd0e
---
FEDORA-2026-178c482e71 (mapserver-8.4.1-3.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproj
Bugzilla
CVE-2026-33721 mapserver: MapServer: Denial of Service via crafted Styled Layer Descriptor [epel-all]
bugzilla·2026-03-27·CVSS 5.3
CVE-2026-33721 [MEDIUM] CVE-2026-33721 mapserver: MapServer: Denial of Service via crafted Styled Layer Descriptor [epel-all]
CVE-2026-33721 mapserver: MapServer: Denial of Service via crafted Styled Layer Descriptor [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-b5a2da2c73 (mapserver-8.6.1-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b5a2da2c73
---
FEDORA-EPEL-2026-43ec22fd0e (mapserver-8.6.1-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-43ec22fd0e
---
FEDORA-2026-b5a2da2c73 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update wi
Wiz
CVE-2026-33721 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-33721 [MEDIUM] CVE-2026-33721 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33721 :
NixOS vulnerability analysis and mitigation
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
Source : NVD
## 7.5
Score
Published March 27, 2026
Severity HIGH
CNA Score 5.3
Affected Technologies
NixOS
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 43.4
Exploi
2026-03-27
Published