CVE-2026-49014
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.
Risk Assessment
Risk of remote code execution on a server processing geospatial data, potentially leading to full system compromise.
Recommendation
It is recommended to update GDAL to version 3.14.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in GDAL
See all- CVE-2026-4738Critical
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in gdal (frmts/zlib/contrib/infback9 modules) associated with the inftree9.C file. This issue affects gdal before version 3.11.0.
- CVE-2026-8213Medium
In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
- CVE-2026-8212Medium
A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.
- CVE-2026-8088Low
A weakness was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the GDfieldinfo function in frmts/hdf4/hdf-eos/GDapi.c. The manipulation can lead to an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 fixes the issue.
- CVE-2026-8087Medium
A security flaw was discovered in OSGeo gdal up to 3.13.0dev-4 in the GDnentries function of frmts/hdf4/hdf-eos/GDapi.c. Manipulation of the DataFieldName argument results in a heap-based buffer overflow, and the attack requires local access.
- CVE-2026-8086Medium
A vulnerability was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the SWnentries function in frmts/hdf4/hdf-eos/SWapi.c. Manipulation of the DimensionName argument leads to a heap-based buffer overflow. The attack must be carried out locally, and the exploit is publicly available.
- CVE-2026-8084Low
A vulnerability was determined in OSGeo GDAL up to 3.13.0dev-4 affecting the memmove function in frmts/hdf4/hdf-eos/SWapi.c of the HDF-EOS Grid File Handler component. The manipulation causes an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 resolves the issue.
Original NVD description (English source)
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS