EUVD-2026-28417
GHSA-jmvp-7877-wr2f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker obtains local system access
-
DeliveryCrafts malformed HDF4 file with short field name string
-
ExploitSupplies file to GDAL tool/application
-
ExecutionGDAL parses field metadata
-
Persistmemmove reads beyond buffer
-
ImpactMemory disclosure or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local execution (AV:L) with user-level privileges (PR:L) on a system with GDAL compiled and installed with HDF4 driver support. The attacker must supply or trick an authorized user into processing a specially crafted HDF4 file via GDAL tools or library calls. The vulnerable code path is triggered specifically when GDAL parses field information from HDF-EOS Grid or Swath structures in HDF4 files; casual HDF4 file access that does not invoke field metadata parsing may not trigger the vulnerability. Default GDAL installations do include HDF4 support if the underlying HDF4 library is available, so this condition is commonly met in geospatial environments. No remote exploitation is possible; no special GDAL configuration is required beyond HDF4 driver availability. |
| Impact | CVSS 1.9 with vector AV:L/AC:L/PR:L indicates low overall severity: local-only attack vector (AV:L), low attack complexity (AC:L), and low privilege requirements (PR:L) significantly limit exploitability scope. EPSS score not provided, but given the low CVSS and localized impact (VA:L with no integrity or confidentiality impact at system level), real-world exploitation risk is minimal. The vulnerability requires an attacker to have local system access with user-level privileges and the ability to supply a crafted HDF4 file to GDAL. While publicly available exploit code exists, the local-only nature and privilege requirement mean this poses risk primarily to systems where untrusted users can execute GDAL on attacker-controlled files. This is a low-priority vulnerability from a network-attack perspective but may matter in multi-tenant or shared-system environments processing user-supplied geospatial data. |
| Exploit ScenarioDerived | An attacker with local system access crafts a malformed HDF4 file containing a field name with a single character wrapped in parentheses or a string shorter than expected. When a GDAL user or application processes this file using the HDF-EOS Grid File Handler (e.g., via gdalinfo or a Python GDAL script), the memmove operation reads beyond the buffer boundary, potentially disclosing sensitive memory contents or triggering a crash. The publicly available POC demonstrates triggering this condition on test files. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 07, 2026
Out-of-bounds read in OSGeo GDAL up to version 3.13.0dev-4 occurs in the HDF-EOS Grid File Handler when parsing malformed HDF4 files, allowing local authenticated attackers to read memory beyond buffer bounds. The vulnerability exists in the memmove operation within SWapi.c and GDapi.c that processes field information without proper bounds validation. Vendor-released patch available in version 3.13.0RC1; publicly available exploit code exists.
RemediationAI
Upgrade GDAL to version 3.13.0RC1 or later, which includes patch a791f70f8eaec540974ec989ca6fb00266b7646c. If upgrading is not immediately feasible, restrict file processing to trusted HDF4 sources and disable HDF4 driver support in GDAL if not required (via compilation options or runtime driver filtering). Additionally, apply operating system-level access controls to limit which users can execute GDAL and supply input files, reducing the attack surface to privileged or system administrators. Monitor GDAL usage logs for attempts to process malformed HDF4 files. See https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 for release notes and https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c for technical details of the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GDAL (Geospatial Data Abstraction Library) is an open-source library for reading and writing raster and vector geospatial data formats. The vulnerability resides in the HDF-EOS (Hierarchical Data Format-Earth Observing System) Grid File Handler component, specifically in functions that parse field metadata from HDF4 files. The vulnerable code performs a memmove operation to strip parentheses from field name strings without validating string length, leading to CWE-125 (Out-of-bounds Read). When a malformed HDF4 file contains a field name string shorter than two characters (e.g., a single character or empty string), the memmove call with a negative or zero length parameter causes reads beyond the allocated buffer. The fix validates string length and checks for parentheses before performing the memory operation, preventing the out-of-bounds read.
Know when Gdal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exce
Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialRefe
A buffer overflow vulnerability in GDAL versions before 3.11.0 within the zlib infback9 module allows remote attackers t
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that
Arbitrary code execution in GDAL 3.1.0 through 3.13.0 arises from a stack-based buffer overflow in the netCDF driver's s
Heap-based buffer overflow in OSGeo GDAL up to version 3.13.0dev-4 allows local authenticated attackers to corrupt memor
Heap-based buffer overflow in OSGeo GDAL's Grid File Handler (GDSDfldsrch function in frmts/hdf4/hdf-eos/GDapi.c) affect
Heap-based buffer overflow in GDAL's HDF4-EOS SWSDfldsrch function (frmts/hdf4/hdf-eos/SWapi.c) allows local authenticat
Heap-based buffer overflow in OSGeo GDAL up to 3.13.0dev-4 within the SWnentries function of the HDF4-EOS module allows
Out-of-bounds read in OSGeo GDAL up to version 3.13.0dev-4 affects the GDfieldinfo function in HDF-EOS module when proce
Exploit-DB