GHSA-r5m4-5vww-w9f5

OSGeo gdal has a heap-based buffer overflow

Source: GitHub Advisory Database (reviewed) Low CVE-2026-8212

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	GDAL	< 3.13.0RC1	3.13.0RC1

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch commit sha is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-8212 advisory
https://github.com/OSGeo/gdal/issues/14398 web
https://github.com/OSGeo/gdal/commit/3e04c0385630e4d42517046d9a4967dfccfeb7fd web
https://github.com/OSGeo/gdal package
https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 web
https://github.com/biniamf/pocs/tree/main/gdal-swsdfldsrch_oob-read web
https://github.com/pypa/advisory-database/tree/main/vulns/gdal/PYSEC-2026-4.yaml web
https://vuldb.com/submit/808127 web
https://vuldb.com/vuln/362429 web
https://vuldb.com/vuln/362429/cti web