CVE-2026-33721MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

Description

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/MapServer/MapServer/security/advisories/GHSA-cv4m-mr84-fgjp ExploitMitigationVendor Advisory
• https://github.com/MapServer/MapServer/releases/tag/rel-8-6-1 ProductRelease Notes
• https://lists.debian.org/debian-lts-announce/2026/04/msg00017.html