Description

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry contains a malformed coordinate. The coordinate parser in `adagucserverEC/CConvertGeoJSON.cpp` indexes `pt.u.array.values[0]` and `pt.u.array.values[1]` and uses `polygon.u.array.length` as a loop bound without first validating the JSON node type or the coordinate length. A coordinate that is an empty array, a one-element array, a scalar, or `null` leads to an out-of-bounds heap read or a NULL pointer dereference. The same unchecked pattern is present in four geometry branches: `Polygon`, `LineString`, `MultiLineString` and `MultiPolygon`. The vulnerable parser runs whenever the server processes a local GeoJSON file, either a configured GeoJSON dataset or a GeoJSON file exposed through the `AutoResource` feature and requested by an unauthenticated WMS request. A crafted GeoJSON file reliably crashes the backend process that handles that request. Version 7.2.2 patches the vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-08-18T17:16:58.410Z",
  "pubdate": "2026-08-18T17:16:58.410Z",
  "executiveSummary": "Adaguc-server versions prior to 7.2.2 contain a memory-safety vulnerability in the GeoJSON coordinate parser. The vulnerability arises from a failure to validate JSON node types and coordinate array lengths during the parsing of geometric structures such as polygons and line strings.\nAn unauthenticated attacker can exploit this flaw by supplying a crafted GeoJSON document containing malformed coordinates, such as empty arrays, single-element arrays, scalars, or null values. When processed by the server, this triggers out-of-bounds heap reads or NULL pointer dereferences.\nThe primary impact of this vulnerability is a denial of service, as it reliably crashes the backend process handling the WMS request. The vulnerability is network-exposed when processing local GeoJSON datasets or files exposed through the AutoResource feature, requiring no authentication or privileges from the attacker.",
  "technicalDetails": "The root cause of the vulnerability resides in the coordinate parser implemented within adagucserverEC/CConvertGeoJSON.cpp. Specifically, the parser directly indexes pt.u.array.values[0] and pt.u.array.values[1] and relies on polygon.u.array.length as a loop bound without performing prior validation of the underlying JSON node type or verifying that the coordinate array contains the expected number of elements.\nThis unchecked pattern is consistently present across four distinct geometry branches: Polygon, LineString, MultiLineString, and MultiPolygon. If an attacker submits a malformed coordinate formatted as an empty array, a one-element array, a scalar, or a null value, the memory access patterns violate safety boundaries.\nThe attack flow begins when the server processes a local GeoJSON file. This file can either be a pre-configured GeoJSON dataset or a file exposed dynamically via the AutoResource feature. An unauthenticated remote attacker initiates the attack by issuing a standard WMS request that references or incorporates the crafted GeoJSON document.\nUpon receiving the request, the backend parser evaluates the geometry branches without input sanitization. Accessing invalid or missing indices within the coordinate array leads directly to out-of-bounds heap read operations or NULL pointer dereferences. This memory-safety violation immediately triggers an unhandled exception or segmentation fault, causing the backend process handling the specific request to crash.\nThe affected component is the GeoJSON parsing engine in adagucserverEC/CConvertGeoJSON.cpp within Adaguc-server versions prior to 7.2.2. Exploitation requires network access to the WMS service and the ability to provision or influence a GeoJSON file processed by the server via configured datasets or the AutoResource mechanism."
}