CVE-2026-50126

Name of the Vulnerable Software and Affected Versions Adaguc-server versions prior to 7.2.2

Description A memory-safety fault occurs when the server parses a GeoJSON document containing malformed coordinates. The coordinate parser in adagucserverEC/CConvertGeoJSON.cpp fails to validate the JSON node type or coordinate length before indexing pt.u.array.values[0] and pt.u.array.values[1] and using polygon.u.array.length as a loop bound. This flaw affects the Polygon, LineString, MultiLineString, and MultiPolygon geometry branches. If a coordinate is a scalar, null, an empty array, or a one-element array, it results in a NULL pointer dereference or an out-of-bounds heap read. The issue is triggered when the server processes a local GeoJSON file, including configured datasets or files exposed via the AutoResource feature requested through an unauthenticated WMS request, leading to a crash of the backend process.

Recommendations Update to version 7.2.2.