OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S‑102 Bathymetric Surface parser. An attacker can supply a crafted S‑102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32‑bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file.

The vulnerability afflicts the OpenS100 Project:OpenS100, affecting any installation that parses S‑102 HDF5 files with the vulnerable parser. No specific version numbers are listed in the CNA data, but the issue is known to exist in code up to commit 2b1dafc.

With a CVSS score of 7.1 the vulnerability is classified as high severity. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, suggesting limited prior exploitation data. The likely attack vector is remote file injection; a malicious actor can supply a crafted S‑102 file containing exaggerated grid dimension values to trigger the integer wrap‑around during parsing. If exploited, the attacker can achieve uncontrolled memory writes that can lead to application crash or code execution on the host system.