Gdal CVE-2026-4738

Requires user interaction to open a crafted file processed by OSGeo GDAL versions before 3.11.0 with zlib/infback9 module enabled. Remote attacker sends malicious file; victim must open it in application using vulnerable GDAL library.

While CVSS score and vector data are not provided, the vulnerability's classification as a buffer overflow in a compression library handling untrusted input represents significant real-world risk. The presence of an available patch from the vendor (GitHub PR #12244) indicates vendor acknowledgment and active remediation. Buffer overflow vulnerabilities in data parsing libraries are historically high-impact due to their potential for memory corruption and code execution. The attack vector is likely network-based or file-based (processing malicious geospatial files), suggesting moderate attack complexity depending on GADL's deployment context. Without EPSS data or KEV status confirmation, the exploitation probability cannot be quantified, but the nature of the flaw (bounds checking failure in a decompression routine) makes it exploitable if an attacker can provide crafted compressed geospatial data to an application using vulnerable GDAL versions. This should be treated as a high-priority fix for systems processing untrusted geospatial data.

An attacker crafts a malicious geospatial file (such as a specially-formatted GeoTIFF or other compressed format handled by GDAL) containing deliberately malformed zlib-compressed data with invalid Huffman tree structures. When a vulnerable GDAL version processes this file, the inftree9.C decompression routine fails to properly validate buffer boundaries, causing a heap or stack buffer overflow. This overflow could corrupt adjacent memory structures, leading to a denial of service (crash) or, in favorable conditions, code execution within the context of the application using GDAL.