PYPI · AUGUST 2026 · EARLY WARNING

resdata Package Vulnerability: Buffer Overflow and More

Q: Am I affected?

You are affected if you are using a version of the resdata package prior to 6.2.9.

Q: What should I do right now?

Immediately upgrade your resdata package to version 6.2.9 or later.

Q: Is this vulnerability being actively exploited?

There is no current evidence that this vulnerability is being exploited in the wild.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: resdata (pypi)
Affected versions: < 6.2.9
Patched version: 6.2.9

GHSA-PR85-W493-9W3X

An early warning has been issued for a vulnerability in the resdata package. Versions prior to 6.2.9 are reportedly affected by multiple issues including buffer overflow and improper input validation.

What happened

The resdata package, available on PyPI, has been flagged with a high-severity vulnerability. This vulnerability, tracked as GHSA-PR85-W493-9W3X, includes a classic buffer overflow, improper validation of array index, NULL pointer dereference, and out-of-bounds read. These issues arise from insufficient validation of input in GRDECL files prior to version 6.2.9.

This vulnerability was first flagged on August 18, 2026. It is currently under investigation and has not been reported as exploited in the wild. Users of the resdata package should assess their exposure by checking the version they are using against the affected range, which is any version prior to 6.2.9.

What to do about it

Upgrade your resdata package to version 6.2.9 or later to mitigate the vulnerability.
Review your project dependencies to ensure that resdata is not indirectly included in an affected version.
Monitor the GitHub Advisory Database and other primary sources for updates on this vulnerability.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If resdata is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using a version of the resdata package prior to 6.2.9.

What should I do right now?

Immediately upgrade your resdata package to version 6.2.9 or later.

Is this vulnerability being actively exploited?

There is no current evidence that this vulnerability is being exploited in the wild.

Sources

[GHSA-pr85-w493-9w3x] resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Join the 0Day waitlist →

← Back to all threats