CVE-2026-8087

EUVD-2026-28435

07.05.2026, 20:16

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 12.92%

Affected Products (NVD)

Vendor	Product	Version
osgeo	gdal	𝑥 ≤ 3.12.4
osgeo	gdal	3.13.0:beta1
osgeo	gdal	3.13.0:beta2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

gdal

bookworm	no-dsa
bullseye	vulnerable
bullseye (security)	vulnerable
forky	3.13.2+dfsg-1 fixed
sid	3.13.2+dfsg-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

gdal

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
trusty	needs-triage
xenial	ignored

Known Exploits!

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

https://github.com/OSGeo/gdal/

https://github.com/OSGeo/gdal/commit/184f77dbcc74118c062c05e464c88161d3c37b9b

https://github.com/OSGeo/gdal/issues/14363

https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1

https://github.com/biniamf/pocs/tree/main/gdal-gdinqfields_bof

https://vuldb.com/submit/808039

https://vuldb.com/vuln/361840

https://vuldb.com/vuln/361840/cti