A stack-based buffer overflow vulnerability in Generic Mapping Tools (GMT) versions 6.6.0 and prior presents a risk of arbitrary code execution for local users.

The vulnerability exists in the gmt_remote_dataset_id function within src/gmt_remote.c. It is a stack-based buffer overflow triggered when an attacker provides an excessively long string as a dataset identifier, which can be achieved through modules such as which.

The ability for an attacker to achieve arbitrary code execution on a host system poses a significant risk to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this flaw is categorized as High severity, as it allows a local attacker to compromise the host environment or cause service disruption.

Immediate Action: Update the GMT software to a version beyond 6.6.0 or apply the fix provided in commit 0ad2b491470df82c9ec1139dcbd70502fa28a082.

Proactive Monitoring: Review system logs for unusual command-line arguments passed to GMT tools, particularly when processing remote datasets, and monitor for unexpected process crashes.

Compensating Controls: Restrict execution permissions for the GMT binary to authorized users only to limit the attack surface for local exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the potential for arbitrary code execution and the availability of public proof-of-concept code, this vulnerability should be prioritized for remediation. Users should immediately update their GMT installation to a version containing the upstream fix to effectively eliminate the buffer overflow risk.