CVE-2026-8088
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A weakness was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the GDfieldinfo function in frmts/hdf4/hdf-eos/GDapi.c. The manipulation can lead to an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 fixes the issue.
Risk Assessment
A local attacker can use a malicious HDF-EOS file to trigger an out-of-bounds read, potentially causing a crash or data exposure. The risk affects systems processing untrusted HDF-EOS files with GDAL up to 3.13.0dev-4.
Recommendation
Upgrade GDAL to version 3.13.0RC1 containing patch a791f70f8eaec540974ec989ca6fb00266b7646c. Avoid processing untrusted HDF-EOS files until the update is deployed.
Other vulnerabilities in GDAL
See all- CVE-2026-4738Critical
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in gdal (frmts/zlib/contrib/infback9 modules) associated with the inftree9.C file. This issue affects gdal before version 3.11.0.
- CVE-2026-49014High
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.
- CVE-2026-8213Medium
In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
- CVE-2026-8212Medium
A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.
- CVE-2026-8087Medium
A security flaw was discovered in OSGeo gdal up to 3.13.0dev-4 in the GDnentries function of frmts/hdf4/hdf-eos/GDapi.c. Manipulation of the DataFieldName argument results in a heap-based buffer overflow, and the attack requires local access.
- CVE-2026-8086Medium
A vulnerability was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the SWnentries function in frmts/hdf4/hdf-eos/SWapi.c. Manipulation of the DimensionName argument leads to a heap-based buffer overflow. The attack must be carried out locally, and the exploit is publicly available.
- CVE-2026-8084Low
A vulnerability was determined in OSGeo GDAL up to 3.13.0dev-4 affecting the memmove function in frmts/hdf4/hdf-eos/SWapi.c of the HDF-EOS Grid File Handler component. The manipulation causes an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
Original NVD description (English source)
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS