---
id: CVE-2026-55209
title: >-
  resdata is software for reading and writing result files from the Eclipse
  reservoir simulator
summary: >-
  resdata is software for reading and writing result files from the Eclipse
  reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric
  fields, grid dimensions, keyword sizes, and array indexes while parsing
  untrusted GRD…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-120
  - CWE-125
  - CWE-129
  - CWE-476
vendor: equinor
product: resdata
affected:
  - resdata < 6.2.9
patched:
  - resdata 6.2.9
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T21:17:13.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55209'
references:
  - url: >-
      https://github.com/equinor/resdata/commit/9f8fd6db472e0696080b768389914d60a453904f
    label: security-advisories@github.com
  - url: >-
      https://github.com/equinor/resdata/commit/d3f45828e9413506b8e8160a9304f4b7b06dcefc
    label: security-advisories@github.com
  - url: >-
      https://github.com/equinor/resdata/commit/ee8cc12b026d945df3077bc98e211ee45f80a433
    label: security-advisories@github.com
  - url: 'https://github.com/equinor/resdata/pull/1166'
    label: security-advisories@github.com
  - url: 'https://github.com/equinor/resdata/releases/tag/6.2.9'
    label: security-advisories@github.com
  - url: 'https://github.com/equinor/resdata/security/advisories/GHSA-pr85-w493-9w3x'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-pr85-w493-9w3x'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
aliases:
  - GHSA-pr85-w493-9w3x
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-14T20:10:56.774434Z'
ingestedAt: '2026-08-18T20:22:15.666Z'
epss: 0.0078
epssPercentile: 0.53976
---

## Overview

resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55209)

Affected packages:

- `resdata < 6.2.9`

Patched in:

- `resdata 6.2.9`

Source: https://github.com/advisories/GHSA-pr85-w493-9w3x