Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-33147 EUVD-2026-13784

GMT: Stack-based Buffer Overflow in gmt_remote_dataset_id

Published Mar 20, 2026 · Updated Mar 25, 2026 · Assigned by GitHub_M

Vendor: GenericMappingTools Product: gmt

Description

GMT is an open source collection of command-line tools for manipulating geographic and Cartesian data sets. In versions from 6.6.0 and prior, a stack-based buffer overflow vulnerability was identified in the gmt_remote_dataset_id function within src/gmt_remote.c. This issue occurs when a specially crafted long string is passed as a dataset identifier (e.g., via the which module), leading to a crash or potential arbitrary code execution. This issue has been patched via commit 0ad2b49.

Affected products

VendorProductAffectedFixed
GenericMappingTools gmt <= 6.6.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • redyank/CVE-2026-33147 ★ 0 · Apr 3, 2026

    CVE-2026-33147(Stack-based Buffer Overflow in gmt_remote_dataset_id)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References