CVE-2026-33147 Details
Description
GMT is an open source collection of command-line tools for manipulating geographic and Cartesian data sets. In versions from 6.6.0 and prior, a stack-based buffer overflow vulnerability was identified in the gmt_remote_dataset_id function within src/gmt_remote.c. This issue occurs when a specially crafted long string is passed as a dataset identifier (e.g., via the which module), leading to a crash or potential arbitrary code execution. This issue has been patched via commit 0ad2b49.
A stack-based buffer overflow vulnerability has been identified in Generic Mapping Tools (GMT) versions through 6.6.0. The issue arises in the gmt_remote_dataset_id function within src/gmt_remote.c, where a specially crafted long string can be passed as a dataset identifier. This vulnerability can lead to a program crash or potentially allow arbitrary code execution. The root cause is the unsafe handling of user-controlled dataset names, which can overwrite the stack frame and return address when exceeding the buffer's size limit. The vulnerability has been confirmed using AddressSanitizer, which reported a stack-buffer-overflow.
Users are advised to update to the patched version of GMT, which is available on the Generic Mapping Tools GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GenericMappingTools/gmt/security/advisories/GHSA-fqxx-62x7-9gwg | CISA-ADP | ExploitVendor Advisory |
| https://github.com/GenericMappingTools/gmt/commit/0ad2b491470df82c9ec1139dcbd70502fa28a082 | [email protected] | Patch |
| https://github.com/GenericMappingTools/gmt/security/advisories/GHSA-fqxx-62x7-9gwg | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| generic-mapping-tools gmt | <= 6.6.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |