CVE-2026-30479 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-30479 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-30479 is a Dynamic-link Library (DLL) injection vulnerability in OSGeo MapServer, an open-source platform widely used for publishing spatial data and interactive mapping applications, affecting all versions prior to v8.0.

Technical Detail

The flaw exists in how MapServer loads dynamic-link libraries at runtime, allowing an attacker to supply a crafted executable that causes the application to load a malicious DLL in place of a legitimate one. Successful exploitation results in arbitrary code execution within the context of the MapServer process, which may carry elevated privileges depending on the deployment environment. The attack requires the ability to place or influence a crafted executable in a location accessible to the MapServer process, which may limit remote exploitation but does not eliminate it in misconfigured or multi-tenant environments.

Exploitation Status

No known exploit code has been publicly identified at this time, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploit maturity is currently assessed as none, meaning no proof-of-concept or operational exploit has been confirmed in open sources as of April 16, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence reporting.

What To Do

Organizations running OSGeo MapServer should upgrade to version 8.0 or later immediately, as this is the confirmed remediated release. Given the critical CVSS score of 9.1, patching should be treated as high priority even in the absence of confirmed active exploitation. Where immediate patching is not feasible, restrict write access to directories from which MapServer loads libraries, enforce least-privilege execution contexts for the MapServer process, and audit the environment for unauthorized executables or DLLs in application directories. Monitor process creation and DLL load events associated with MapServer processes using endpoint detection tooling to identify potential exploitation attempts.