Adaguc-server's GeoJSON coordinate parser in CConvertGeoJSON.cpp accesses array indices without validating the node type or coordinate length, leading to out‑of‑bounds heap reads and NULL pointer dereferences. A malformed coordinate such as an empty array, one‑element array, scalar, or null triggers a crash of the backend process that handles the request, resulting in a denial of service to the server’s WMS service.

The vulnerability affects the open‑source geographical information system adaguc‑server from KNMI. All releases prior to version 7.2.2 are impacted. The bug is present in four geometry handling branches: Polygon, LineString, MultiLineString, and MultiPolygon.

The vulnerability has a CVSS score of 4.0, indicating low severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. However, the exploit path exists when a GeoJSON document is parsed during the processing of either a configured GeoJSON dataset or a GeoJSON file served through the AutoResource feature. An attacker can trigger the crash by submitting a crafted GeoJSON file in an unauthenticated WMS request or by placing a malicious file on the system where the server reads local GeoJSON data. The impact is limited to service interruption, with no direct remote code execution or data disclosure.