CVE-2026-33721: 
NixOS vulnerability analysis and mitigation

CVE-2026-33721 is a heap-buffer-overflow write vulnerability in MapServer's SLD (Styled Layer Descriptor) parser that allows a remote, unauthenticated attacker to crash the MapServer process, resulting in a denial of service. It affects MapServer versions 4.2 through 8.6.0 (all versions prior to 8.6.1). The vulnerability was published on March 27, 2026, with the patch released on March 23, 2026 as part of MapServer 8.6.1. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the GitHub advisory rates it as Moderate (5.3) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-787: Out-of-bounds Write) lies in the msSLDParseRasterSymbolizer function in src/mapogcsld.cpp. The parser allocates papszThresholds for 100 entries (nMaxThreshold = 100) and increments nThresholds per Threshold element, but the buffer growth check incorrectly tests nValues == nMaxThreshold (where nValues counts XML nodes) instead of nThresholds == nMaxThreshold. When a crafted SLD ColorMap/Categorize structure contains more than 100 Threshold elements, the code writes 8-byte pointers past the end of the heap-allocated array, causing an ASAN heap-buffer-overflow. The attack is reachable remotely with no authentication via a WMS GetMap request using the SLD_BODY parameter, requiring no user interaction. The fix is a one-line change replacing nValues with nThresholds in the growth check (GitHub Advisory).

Successful exploitation causes a crash of the MapServer process, resulting in a denial of service for all users of the affected GIS web application. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Deployments that accept attacker-controlled SLD input (particularly WMS services with SLD_BODY enabled) are most at risk, and repeated exploitation could result in sustained service unavailability (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) is publicly available in the GitHub security advisory, including a MapServer MAP configuration and OSS-Fuzz reproduction instructions that demonstrate triggering the crash. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.0021 (0.21%), indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA KEV catalog. The vulnerability was originally discovered by Anthropic using Claude for automated vulnerability discovery, then validated by Trail of Bits (GitHub Advisory).

1. Reconnaissance: Identify internet-facing MapServer instances (versions 4.2–8.6.0) that expose WMS endpoints, using tools like Shodan or Censys searching for MapServer banners or OGC WMS service endpoints.
2. Confirm SLD_BODY support: Send a benign WMS GetMap request with a minimal SLD_BODY parameter to confirm the server parses attacker-supplied SLD content.
3. Craft malicious SLD: Construct an SLD XML document containing a ColorMap with a Categorize function that includes more than 100 Threshold child elements, exceeding the fixed buffer size of 100 entries.
4. Deliver the payload: Submit the crafted SLD via an HTTP GET or POST request to the WMS endpoint, e.g., GET /cgi-bin/mapserv?SERVICE=WMS&REQUEST=GetMap&SLD_BODY=<crafted_sld>...
5. Trigger crash: The MapServer process parses the malicious SLD, writes past the end of the papszThresholds heap array, and crashes — causing a denial of service for all concurrent and subsequent users (GitHub Advisory).

• Network: Unusual WMS GetMap HTTP requests containing SLD_BODY parameters with large XML payloads (>100 Threshold elements inside a ColorMap/Categorize structure); repeated requests from the same source IP targeting the WMS endpoint.
• Logs: MapServer error logs (MS_ERRORFILE) showing segmentation faults or abnormal process termination; web server access logs with HTTP 500 errors or connection resets following WMS GetMap requests with SLD_BODY.
• Process: Unexpected crashes or restarts of the MapServer CGI/FastCGI process; ASAN heap-buffer-overflow reports in debug builds referencing msSLDParseRasterSymbolizer in src/mapogcsld.cpp.

Upgrade MapServer to version 8.6.1 or later, which corrects the off-by-one variable error in the Categorize Threshold growth check (GitHub Release). Note that branches 7.6, 8.0, 8.2, and 8.4 are unsupported and will not receive patches; all users should migrate to the 8.6.x branch. For organizations unable to patch immediately, implement network-level controls to restrict or block WMS GetMap requests containing SLD_BODY parameters to trusted sources only, or disable SLD functionality entirely if not operationally required (GitHub Advisory).

The vulnerability was notably discovered through Anthropic's research program using Claude (a large language model) for automated vulnerability discovery in open source software, with findings independently triaged and validated by Trail of Bits — representing a notable example of AI-assisted security research leading to a confirmed CVE. The advisory credits kevin-valerio as the reporter. Linux distribution maintainers (Debian, Fedora, openSUSE, SUSE) have issued security updates packaging the fix, indicating broad ecosystem response (GitHub Advisory).