CVE-2026-33147: 
NixOS vulnerability analysis and mitigation

CVE-2026-33147 is a stack-based buffer overflow vulnerability in the gmt_remote_dataset_id function within src/gmt_remote.c of the Generic Mapping Tools (GMT) software. It affects GMT versions 6.6.0 and earlier, and was published on March 20, 2026, with the security advisory (GHSA-fqxx-62x7-9gwg) published by the maintainer on March 17, 2026. The vulnerability can lead to application crashes or potential arbitrary code execution when a specially crafted long string is passed as a dataset identifier. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is the unsafe use of strcpy (an unbounded string copy operation) when copying a user-controlled dataset name into a fixed-size stack buffer file[PATH_MAX] in the gmt_remote_dataset_id function (CWE-121: Stack-based Buffer Overflow; CWE-120: Buffer Copy without Checking Size of Input). When an input string exceeds PATH_MAX (typically 4096 bytes), it overwrites the stack frame including the return address, enabling control-flow hijacking. The attack vector is local, requiring user interaction (e.g., a user invoking the which module with a malicious dataset identifier), and no privileges are required. The fix replaces the unsafe strcpy call with strncpy bounded to PATH_MAX - 1 and explicitly null-terminates the buffer (GitHub Advisory, Patch Commit).

Successful exploitation allows a local attacker to cause a crash (denial of service) or execute arbitrary code with the privileges of the GMT process. Confidentiality, integrity, and availability are all rated as high impact, meaning an attacker could read sensitive data accessible to the GMT process, modify data, or fully disrupt the application. The scope is limited to the affected system and process, with no direct lateral movement capability, but privilege escalation within the local environment is possible if GMT runs with elevated permissions (GitHub Advisory, Red Hat).

A proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, consisting of a Python script using the PyGMT library that constructs a malicious payload exceeding 4096 bytes and triggers the overflow via the which module. The vulnerability was confirmed using AddressSanitizer (ASan). As of the time of reporting, there is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.014% (0.000140), indicating a low probability of exploitation in the near term (GitHub Advisory).

1. Reconnaissance: Identify systems running GMT version 6.6.0 or earlier, particularly those where users or scripts invoke GMT command-line tools or the PyGMT Python library with externally supplied dataset identifiers.
2. Craft malicious payload: Construct a dataset identifier string exceeding PATH_MAX (4096 bytes). For example, using Python:

import struct
from pygmt.clib import Session

with Session() as lib:
    padding = "A" * 4096
    fake_ret = struct.pack("<Q", 0x4141414141414141) * 100
    payload = padding + fake_ret.decode("latin-1")
    lib.call_module("which", [payload])

3. Trigger the overflow: Pass the crafted string as a dataset identifier to the gmt_remote_dataset_id function, either via the which module directly or through any GMT command that processes dataset identifiers.
4. Overwrite return address: The oversized input overflows the fixed-size file[PATH_MAX] stack buffer in src/gmt_remote.c, overwriting the stack frame and return address with attacker-controlled data.
5. Achieve code execution: If stack protections (e.g., stack canaries, ASLR) are bypassed or absent, the attacker gains control of the instruction pointer and can redirect execution to a shellcode or ROP chain, achieving arbitrary code execution with GMT process privileges (GitHub Advisory).

• Process: GMT or PyGMT processes crashing unexpectedly with segmentation faults or stack-buffer-overflow errors reported by AddressSanitizer; unusual child processes spawned by the GMT process (e.g., shells or network utilities).
• Logs: Application crash logs or core dumps referencing gmt_remote_dataset_id in src/gmt_remote.c; ASan output indicating stack-buffer-overflow at the strcpy/strncpy call site.
• File System: Unexpected core dump files (e.g., core, core.<pid>) in the working directory of GMT processes; new or modified files created by the GMT process in unexpected locations.
• Network: Outbound connections from the GMT process to unexpected external hosts, which may indicate post-exploitation activity if code execution was achieved.

The vulnerability is patched via commit 0ad2b491470df82c9ec1139dcbd70502fa28a082, which replaces the unsafe strcpy with a length-bounded strncpy call. Users should update GMT to any version newer than 6.6.0 that includes this fix. As a workaround, restrict local access to GMT command-line tools and validate or limit the length of dataset identifier inputs before they are passed to GMT functions to prevent strings exceeding PATH_MAX from being processed (Patch Commit, Red Hat Bugzilla).