What is the CVSS score of CVE-2026-49014?

CVE-2026-49014 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of GDAL are affected by CVE-2026-49014?

GDAL, a widely-deployed geospatial data processing library, contains an arbitrary code execution vulnerability in versions 3.1.0 through 3.13.0 triggered by processing malicious NetCDF files,…. A patch is available.

How to fix or mitigate CVE-2026-49014?

Within 24 hours, complete an inventory of all systems and applications running GDAL 3.1.0-3.13.0 using package management tools and dependency tracking; restrict or monitor network access to untrusted geospatial data sources and disable public NetCDF file uploads pending remediation. Within 7 days, apply the vendor-released patch to upgrade all affected GDAL installations to the patched version per the official advisory; validate the patched version against geospatial processing workflows to ensure production compatibility. Within 30 days, conduct a full audit of NetCDF processing pipelines across the organization, implement input validation or file scanning controls for geospatial data processing, and review security logs for any exploitation attempts during the unpatched period.

GDAL CVE-2026-49014

EUVD-2026-32039 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-27 cve@mitre.org

GHSA-wphc-7cm7-8mf7

RCE Stack Overflow Buffer Overflow Gdal

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-parsing overflow triggered by an attacker-supplied NetCDF file: AV:L and AC:L for reliable local triggering, PR:L since a low-priv channel must submit the file, full C/I/A from code execution.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 11:22 NVD

7.4 (HIGH) 7.8 (HIGH)

Analysis Generated

May 27, 2026 - 20:39 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on gdal (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.0.

DescriptionNVD

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.

AnalysisAI

Arbitrary code execution in GDAL 3.1.0 through 3.13.0 arises from a stack-based buffer overflow in the netCDF driver's scanForGeometryContainers routine (frmts/netcdf/netcdfsg.cpp), which reads a geometry attribute into a fixed-size stack buffer without validating its length. An attacker who can get a GDAL-based service to parse a crafted NetCDF file containing an oversized geometry attribute can overflow the buffer and run code in the context of the process. Publicly available exploit code exists per the SSVC 'poc' status, but EPSS is very low (0.01%, 3rd percentile) and it is not on the CISA KEV list, so no active exploitation is confirmed.

Technical ContextAI

GDAL (Geospatial Data Abstraction Library) is a foundational open-source raster/vector translation library maintained by OSGeo (CPE cpe:2.3:a:osgeo:gdal) and embedded in a large share of GIS, mapping, and geospatial processing stacks (QGIS, PostGIS, MapServer, Python/R geospatial toolchains, cloud imagery pipelines). The flaw lives in the netCDF driver, which parses NetCDF scientific-data files, specifically the simple-geometries (netcdfsg) code that scans geometry container attributes. The root cause is CWE-121 (stack-based buffer overflow): scanForGeometryContainers copies an attacker-controlled geometry attribute into a fixed-length stack array without bounds-checking the attribute length, so an oversized value overwrites adjacent stack memory including saved registers/return data, enabling control-flow hijack.

RemediationAI

Patch available per vendor advisory: upgrade to a fixed GDAL release above 3.13.0 once published by OSGeo - track the fix via the upstream issue https://github.com/OSGeo/gdal/issues/14594 and confirm the exact patched version there before deploying, as no tagged fix version is present in the supplied data (do not rely on an assumed version number). If patching cannot be done immediately, the most effective compensating control is to stop GDAL from parsing untrusted NetCDF input: disable or unregister the netCDF driver (for example by building/configuring GDAL without netCDF support or restricting GDAL_SKIP/allowed drivers), which removes the vulnerable code path at the cost of losing NetCDF read capability. Additionally, restrict which principals can submit NetCDF files to any GDAL-backed ingestion endpoint and validate/quarantine uploaded geospatial files, sandbox the GDAL process (least-privilege service account, seccomp/container isolation), so a successful overflow cannot execute code with broad rights. Cross-reference the vuldb advisory (https://vuldb.com/vuln/365851) for tracking.