CVE-2025-15537: 
NixOS vulnerability analysis and mitigation

CVE-2025-15537 is a heap-based buffer overflow vulnerability in Mapnik, an open-source C++ toolkit for developing mapping applications. The flaw resides in the mapnik::dbf_file::string_value function within plugins/input/shape/dbfile.cpp, triggered when parsing malformed DBF (dBASE) files via the Shapefile input plugin. It affects Mapnik versions up to and including 4.2.0. The vulnerability was first reported via a GitHub issue on December 19, 2025, and publicly disclosed on January 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NIST NVD (Red Hat Advisory, Mapnik Issue).

The root cause is insufficient bounds checking in the dbf_file::string_value function (CWE-122: Heap-based Buffer Overflow; CWE-787: Out-of-bounds Write). During DBF file parsing, the function reads field values using an offset or length derived from the file header without validating these values against the actual size of the heap-allocated buffer (362 bytes). This allows a std::string constructor call at dbfile.cpp:92 to read 112 bytes beyond the allocated region, triggering a SIGABRT/crash confirmed via AddressSanitizer. Exploitation requires local access and the ability to supply a malformed DBF file to an application using Mapnik's Shapefile plugin. A public reproducer file is available (Mapnik Issue, PoC Repro).

Successful exploitation can cause a process crash (denial of service) due to the out-of-bounds heap read triggering an abort signal. Depending on heap layout and application context, the overflow may also result in limited unauthorized information disclosure or data corruption. Systems that process untrusted or externally supplied DBF/Shapefile data — such as geospatial data pipelines or mapping servers — are at particular risk (Red Hat Advisory, Feedly).

A public proof-of-concept reproducer file has been disclosed via GitHub and VulDB, making exploitation straightforward for anyone with local access to a vulnerable system. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Mapnik Issue, VulDB).

1. Prepare a malformed DBF file: Craft a DBF file with a manipulated header that specifies field lengths or offsets exceeding the actual allocated buffer size. A public reproducer file is available at https://github.com/oneafter/1218/blob/main/repro.
2. Identify a vulnerable target: Locate a system running Mapnik ≤ 4.2.0 with the Shapefile input plugin enabled, where a local user account or process can supply input files.
3. Supply the malformed file: Pass the crafted DBF file to a Mapnik-based application (e.g., a mapping harness or geospatial processing tool) that invokes the Shapefile plugin, triggering dbf_file::string_value to parse the file.
4. Trigger the overflow: The string_value function at dbfile.cpp:92 constructs a std::string using an out-of-bounds length derived from the malformed header, causing a heap-buffer-overflow read of 112 bytes beyond the allocated region.
5. Achieve denial of service (or further impact): The process aborts with SIGABRT, causing a crash. Depending on heap layout, memory contents adjacent to the buffer may be disclosed or corrupted (Mapnik Issue, PoC Repro).

• Process: Unexpected SIGABRT or crash of a Mapnik-based application process; AddressSanitizer output referencing heap-buffer-overflow in dbf_file::string_value at plugins/input/shape/dbfile.cpp:92.
• Logs: Application crash logs or core dumps referencing mapnik::dbf_file::string_value; error messages from the Shapefile input plugin during DBF file parsing.
• File System: Presence of unexpected or externally sourced .dbf files in directories processed by Mapnik applications; files with anomalous header field length values.
• Network: Unusual file transfers delivering .dbf or .shp files to systems running Mapnik-based services from untrusted sources (Mapnik Issue).

Upgrade Mapnik to a version beyond 4.2.0; the Mapnik project has released v4.2.2 (as of March 30, 2026) which should be evaluated for the fix (Mapnik GitHub). Until patching is possible, restrict local user access to systems running vulnerable Mapnik versions and prevent processing of untrusted or externally supplied DBF/Shapefile data. Implement strict input validation and sandboxing for geospatial file processing pipelines. Monitor Red Hat's advisory for downstream package updates (Red Hat Advisory, Red Hat Bugzilla).

The Mapnik project had not responded to the issue report at the time of initial disclosure, as noted in the CVE description. Red Hat tracked the vulnerability via Bugzilla (Bug 2430673) and published a security advisory. No significant public researcher commentary or media coverage beyond standard vulnerability aggregator reporting has been identified (Red Hat Advisory, Red Hat Bugzilla).