CVE-2026-4738

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.

In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.

A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.

A weakness was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the GDfieldinfo function in frmts/hdf4/hdf-eos/GDapi.c. The manipulation can lead to an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 fixes the issue.

A security flaw was discovered in OSGeo gdal up to 3.13.0dev-4 in the GDnentries function of frmts/hdf4/hdf-eos/GDapi.c. Manipulation of the DataFieldName argument results in a heap-based buffer overflow, and the attack requires local access.

A vulnerability was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the SWnentries function in frmts/hdf4/hdf-eos/SWapi.c. Manipulation of the DimensionName argument leads to a heap-based buffer overflow. The attack must be carried out locally, and the exploit is publicly available.

A vulnerability was determined in OSGeo GDAL up to 3.13.0dev-4 affecting the memmove function in frmts/hdf4/hdf-eos/SWapi.c of the HDF-EOS Grid File Handler component. The manipulation causes an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 resolves the issue.