CVE-2026-49014
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.
Risk Assessment
Risk of remote code execution on a server processing geospatial data, potentially leading to full system compromise.
Recommendation
It is recommended to update GDAL to version 3.14.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in GDAL
See all- CVE-2026-4738Critical
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in gdal (frmts/zlib/contrib/infback9 modules) associated with the inftree9.C file. This issue affects gdal before version 3.11.0.
- CVE-2026-8213Medium
In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
- CVE-2026-8212Medium
A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.
Original NVD description (English source)
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.