CVE-2026-35001: Integer Overflow in OpenS100 Bathymetric Parser

OpenS100 through commit daa35b is vulnerable to a heap-based buffer overflow stemming from an integer overflow in the S-102 Bathymetric Surface parser. The vulnerability exists within the S102_VG_BathymetryCoverage::Read() function. An attacker can exploit this by providing a specially crafted S-102 HDF5 file containing malicious grid dimension metadata. During the calculation of grid points, the multiplication of the numPointsLatitudinal and numPointsLongitudinal variables is performed without proper validation, leading to a 32-bit integer wraparound. This creates an undersized heap buffer, which the subsequent copy operation overflows. Depending on the environment, this vulnerability may result in an application crash (Denial of Service) or arbitrary code execution. This is particularly relevant for systems processing maritime bathymetric data, as the vulnerability is triggered upon the parsing of untrusted S-102 dataset files.

Impact

Successful exploitation of this vulnerability in an environment processing maritime data can lead to arbitrary code execution, potentially allowing an attacker to gain control over systems utilizing the OpenS100 library. The impact is significant for maritime monitoring, hydrographic data management, or research sectors that rely on the OpenS100 framework to process S-102 standard datasets. If leveraged, an attacker could move laterally through a network, exfiltrate sensitive hydrographic data, or cause widespread service disruption via recurring application crashes.

Recommendation

• Identify all systems utilizing the OpenS100 library by scanning for the presence of the library in compiled binaries or dependency manifests.
• Restrict the ingestion of untrusted S-102 bathymetric HDF5 files until the library is patched.
• Upgrade all instances of OpenS100 to a version beyond commit daa35b or apply the vendor-provided patch addressing the integer overflow in the S102_VG_BathymetryCoverage::Read() function.
• Implement memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on systems processing these files to increase the difficulty of successful exploitation.