MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20476-1 advisory.

    Changes in mapserver:

    - Update to release 8.6.1
      * msSLDParseRasterSymbolizer: fix potential heap buffer overflow         [boo#1260869] [CVE-2026-33721]
      * GetFeatureInfo with IDENTIFY CLASSAUTO: take into account         SYMBOL.ANCHORPOINT
      * WCS 2.0: fix issue when input raster in a rotated pole lon/lat         CRS with lon_0?> 180
      * UVRaster: fix WMS-Time support on layers with TILEINDEX         pointing to a shapefile
      * WMS GetCapabilities response: use group title and abstract when         using wms_layer_group instead of GROUP

    - Update to release 8.6.0
      * Add `CONNECTIONTYPE RASTERLABEL`
      * Set `MS_LEGEND_KEYSIZE_MAX` to 1000
      * Add 4 new `COMPOSITE.COMPOP` blending operations
      * Allow encryption key files to use paths relative to a mapfile
      * Allow `use_default_extent_for_getfeature` to be used for OGC         Features API and PostGIS
      * Allow append of additional query parameters for OGCAPI
      * New MapServer index page
      * WMS `GetFeatureInfo`: add options to precisely identify points         through their symbols
      * Add `FALLBACK` parameter for the `CLASS` object, to be applied         if none of the previously defined classes has been applied

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-178c482e71 advisory.

    Backport fix for CVE-2026-33721.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d7e0a8b45 advisory.

    Backport fix for CVE-2026-33721.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to     version 8.6.1, a heap-buffer-overflow write in MapServer's SLD (Styled Layer Descriptor) parser lets a     remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100     Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with     SLD_BODY). Version 8.6.1 patches the issue. (CVE-2026-33721)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
305834	openSUSE 16 Security Update : mapserver (openSUSE-SU-2026:20476-1)	Nessus	SuSE Local Security Checks	high
305029	Fedora 42 : mapserver (2026-178c482e71)	Nessus	Fedora Local Security Checks	high
305028	Fedora 43 : mapserver (2026-6d7e0a8b45)	Nessus	Fedora Local Security Checks	high
304168	Linux Distros Unpatched Vulnerability : CVE-2026-33721	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33721

high

Tenable Plugins

high

high

high

high