CVE-2026-4738
CriticalSummary
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in gdal (frmts/zlib/contrib/infback9 modules) associated with the inftree9.C file. This issue affects gdal before version 3.11.0.
Risk Assessment
The flaw could lead to program crash or potentially arbitrary code execution, posing a risk to systems processing geospatial data.
Recommendation
Update gdal to version 3.11.0 or later, which includes the fix.
Other vulnerabilities in gdal
See all- CVE-2026-49014High
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.
- CVE-2026-8213Medium
In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
- CVE-2026-8212Medium
A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.
Original NVD description (English source)
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C. This issue affects gdal: before 3.11.0.