GMT versions 6.6.0 and earlier have a stack-based buffer overflow in the gmt_remote_dataset_id function in src/gmt_remote.c. An attacker who supplies an unusually long dataset identifier string—such as via the which module—can trigger the overflow, potentially corrupting the stack and leading to a crash or arbitrary code execution. This weakness is classified as CWE-121, indicating improper buffer bounds handling.

The vulnerability affects the GenericMappingTools GMT command‑line suite. All releases up to and including version 6.6.0 are impacted. Systems that run these older GMT binaries and process dataset identifiers derived from external input are susceptible.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The issue is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be local, requiring the attacker to execute GMT with crafted input or have some form of local or privileged access to trigger the overflow.