When Fail-Secure Is Not Fail-Safe: Parser Safety in S-100 Maritime Navigation

Safety-critical maritime navigation depends on machine-readable data products. Their digital signatures establish provenance and integrity but do not guarantee that authenticated content can be parsed safely: even passive data containing no executable code can drive allocation through file-supplied metadata. Using OpenS100, an open S-100 reference implementation, this paper asks whether passive S-102 products can compromise parser memory safety and whether operating system protection alone preserves availability. This paper analyzed the S-102 bathymetric surface specification, built a structurally valid proof-of-concept file with inconsistent grid metadata, and ran it under strong and weak operating system protection across repeated trials. The file triggered an integer overflow and heap buffer overflow without an executable payload. Under strong memory protection, no tested exploit achieved code execution; process termination dominated and the base trigger produced deterministic denial of service, a Fail-Secure outcome that still removed the navigation display. Under weak protection, existing-function reuse achieved Arbitrary Code Execution (ACE) in 14 of 200 launches (7.0%). Neither preserved safe-navigation continuity in the tested application. A four-layer application-level validation sequence applied before allocation prevented both, with no workload-dominant overhead in three desktop microbenchmarks. Passive data are therefore security-relevant parser inputs; preserving both security and availability requires validation before corruption occurs.