CVE-2009-0839

Vendorosgeo, umnProductmapserverDiscoveredMar 31, 2009UpdatedApr 23, 2026

Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.

View graph Watch Export

CVSS v3.1

—

EPSS

9.01%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

Connections

3 relationships

CWE-119

source

Timeline

disclosure → media coverage

Mar 31, 2009

Disclosure — published as a CVE record. · last revised by NVD Apr 23, 2026