GHSA-pr85-w493-9w3x

Source

https://github.com/advisories/GHSA-pr85-w493-9w3x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pr85-w493-9w3x/GHSA-pr85-w493-9w3x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pr85-w493-9w3x

Aliases

Published

2026-08-18T20:11:04Z

Modified

2026-08-19T12:55:43Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Details

Impact

Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice.

Patches

The bug has been patched starting with version 6.2.9.

Database specific

{
    "cwe_ids":  [
        "CWE-120",
        "CWE-125",
        "CWE-129",
        "CWE-476"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-18T20:11:04Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / resdata

Package

Name: resdata; View open source insights on deps.dev
Purl: pkg:pypi/resdata

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.2.9

Affected versions

3.*

3.0.1

4.*

4.0.0

4.1.0

4.1.1

4.1.2

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

5.*

5.0.0b0

5.0.0

5.0.1

5.0.2

5.0.3

5.1.0

5.1.1

5.1.2

5.1.3

6.*

6.0.1

6.1.0

6.2.0

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

6.2.7

6.2.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pr85-w493-9w3x/GHSA-pr85-w493-9w3x.json"