What is GHSA-rcr2-hggw-43wm?

GHSA-rcr2-hggw-43wm is a security advisory published by GitHub Security Advisories with Critical severity. surfio has an out-of-bounds read

Which CVE IDs does GHSA-rcr2-hggw-43wm cover?

GHSA-rcr2-hggw-43wm covers the following CVE IDs: CVE-2026-55211. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rcr2-hggw-43wm?

GHSA-rcr2-hggw-43wm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-rcr2-hggw-43wm?

GHSA-rcr2-hggw-43wm affects 1 product, including: pip/surfio:\u003c 0.0.19.

GHSA-rcr2-hggw-43wmCriticalCVSS 9.8

surfio has an out-of-bounds read

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-55211 →

📋 Description

Impact

Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.

Patches

The bug has been patched in version 0.0.19

🎯 Affected products1

pip/surfio:< 0.0.19

🔗 References (5)

https://github.com/equinor/surfio/security/advisories/GHSA-rcr2-hggw-43wm
https://github.com/equinor/surfio/pull/86
https://github.com/equinor/surfio/commit/1619750bce28e39c4f378d2fb6d28b72380a12aa
https://github.com/equinor/surfio/releases/tag/0.0.19
https://github.com/advisories/GHSA-rcr2-hggw-43wm