CVE-2026-8084

LOW

OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds

Title source: cna
STIX 2.1

Description

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.

References (9)

Core 9
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-361838 | OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds
https://vuldb.com/vuln/361838
Signature, Permissions Required signature permissions-required
VDB-361838 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/361838/cti
Third Party Advisory third-party-advisory
Submit #808034 | OSGeo GDAL 3.13.0dev Out-of-Bounds Read
https://vuldb.com/submit/808034
Issue Tracking issue-tracking
https://github.com/OSGeo/gdal/issues/14378

Scores

CVSS v3 3.3
EPSS 0.0026
EPSS Percentile 17.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-125
Status published
Products (4)
osgeo/gdal 3.13.0 beta1 (2 CPE variants)
osgeo/gdal < 3.12.4
OSGeo/gdal 3.13.0RC1
OSGeo/gdal 3.13.0dev-4
Published May 07, 2026
Tracked Since May 08, 2026