A heap buffer overflow occurs in the Styled Layer Descriptor (SLD) parser of MapServer when more than 100 Threshold elements are present in a ColorMap/Categorize block. An attacker can supply a crafted SLD via the WMS GetMap request (using the SLD_BODY parameter) to trigger the overflow, causing the MapServer process to crash. The overflow is a classic memory corruption flaw (CWE‑787) that leads to a denial‑of‑service condition.

This weakness impacts MapServer versions starting from 4.2 up to, but not including, 8.6.1. The affected product is the MapServer GIS server developed by OSGeo.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to a MapServer instance that accepts SLD_BODY in WMS GetMap requests, but no authentication is required. Once the crafted SLD is processed, the server crashes, interrupting availability for all clients until restarted.