GDAL vulnerabilities
4 known CVE vulnerabilities in GDAL, translated and rated.
- CVE-2026-4738Critical
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in gdal (frmts/zlib/contrib/infback9 modules) associated with the inftree9.C file. This issue affects gdal before version 3.11.0.
- CVE-2026-49014High
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.
- CVE-2026-8213Medium
In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
- CVE-2026-8212Medium
A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.