MapServer parses styled layer descriptors (SLD) using a Categorize function that allows a client to specify a Threshold for each color in a ColorMap. When a crafted SLD contains more than 100 Threshold elements inside a ColorMap/Categorize structure, the parser writes beyond the allocated heap buffer, causing a heap‑buffer‑overflow. The resulting overflow generally crashes the MapServer process, leading to a denial‑of‑service attack. The vulnerability is identified as a heap buffer overflow (CWE‑787) and does not provide a direct path to code execution.

MapServer, the open‑source web‑GIS platform, is impacted from version 4.2 up to, but not including, 8.6.1. Any deployment running a vulnerable MapServer instance that accepts remote SLD_BODY requests over the Web Map Service (WMS) interface is susceptible. Version 8.6.1 and later contain the patch that eliminates the overflow bug.

With a CVSS score of 5.3, the severity is considered medium; exploitation requires a remote, unauthenticated attacker to deliver a crafted SLD through the WMS GetMap request. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation today. Nonetheless, because the condition can be triggered remotely, the risk to availability remains significant for exposed services.