CVE-2026-8087
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A security flaw was discovered in OSGeo gdal up to 3.13.0dev-4 in the GDnentries function of frmts/hdf4/hdf-eos/GDapi.c. Manipulation of the DataFieldName argument results in a heap-based buffer overflow, and the attack requires local access.
Risk Assessment
A local attacker can exploit the buffer overflow to execute arbitrary code or crash the application. The risk affects systems processing untrusted HDF4 files.
Recommendation
Upgrade GDAL to version 3.13.0RC1 or later containing patch 184f77dbcc74118c062c05e464c88161d3c37b9b. Avoid processing untrusted HDF4 files until updated.
Other vulnerabilities in GDAL
See all- CVE-2026-4738Critical
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in gdal (frmts/zlib/contrib/infback9 modules) associated with the inftree9.C file. This issue affects gdal before version 3.11.0.
- CVE-2026-49014High
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.
- CVE-2026-8213Medium
In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
- CVE-2026-8212Medium
A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.
- CVE-2026-8088Low
A weakness was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the GDfieldinfo function in frmts/hdf4/hdf-eos/GDapi.c. The manipulation can lead to an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 fixes the issue.
- CVE-2026-8086Medium
A vulnerability was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the SWnentries function in frmts/hdf4/hdf-eos/SWapi.c. Manipulation of the DimensionName argument leads to a heap-based buffer overflow. The attack must be carried out locally, and the exploit is publicly available.
- CVE-2026-8084Low
A vulnerability was determined in OSGeo GDAL up to 3.13.0dev-4 affecting the memmove function in frmts/hdf4/hdf-eos/SWapi.c of the HDF-EOS Grid File Handler component. The manipulation causes an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
Original NVD description (English source)
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS