OSGeo GDAL CVE-2026-8086

Exploitation requires: (1) Local system access - remote exploitation is not possible; (2) Authenticated user privileges (non-root/unprivileged user acceptable per CVSS PR:L); (3) Ability to provide or place a crafted HDF4 file where GDAL will process it, typically through file upload, shared storage, or direct file creation if the attacker has filesystem write access; (4) GDAL must be built with HDF4 support enabled (--with-hdf4 flag during compilation). The vulnerability is not triggered by default GDAL installations without HDF4 backend. Limiting factors: The buffer overflow is confined to metadata dimension name processing within the HDF4-EOS module, not the main data reading path. Memory protections (DEP/NX bit, heap canaries on some platforms) may prevent exploitation for code execution even if the overflow is triggered. Non-default configurations (disabling HDF4 support, running GDAL in sandboxed environments, restricting HDF4 file processing) effectively eliminate risk.

The CVSS v4.0 vector (AV:L/AC:L/PR:L) indicates local attack vector with low complexity and requirement for low-level user privileges, not unauthenticated remote exploitation. CVSS impact scores (VC:L/VI:L/VA:L) indicate low confidentiality, integrity, and availability impact - unusual for a heap buffer overflow but suggesting the overflow is constrained in scope or the impacted memory region has limited security consequences. EPSS data is not provided. The CVSS score of 1.9 is exceptionally low for a buffer overflow, suggesting either the memory corruption is difficult to exploit for meaningful impact, is mitigated by memory protections (ASLR, heap hardening), or affects only diagnostic/metadata operations rather than data integrity. The presence of publicly available POC code indicates technical feasibility of triggering the overflow, but the low CVSS impact rating suggests real-world severity is limited. Exploitation requires: (1) local system access, (2) authenticated user privileges (PR:L), (3) ability to provide crafted HDF4 files with malformed DimensionName fields. This is notably different from remote code execution or privilege escalation scenarios. The fix is released and available, making this a straightforward patch priority despite the buffer overflow classification.

An authenticated local user with access to a system running GDAL (e.g., a shared scientific computing server) crafts a malicious HDF4 file with specially crafted DimensionName fields containing unquoted strings exceeding expected buffer lengths. When GDAL processes this file through the SWnentries function to enumerate dataset dimensions, the buffer overflow occurs in heap memory. While the low CVSS impact suggests the overflow does not directly lead to code execution or significant data corruption, it could cause a denial-of-service crash or potentially corrupt adjacent heap structures if exploitable. The publicly available POC (github.com/biniamf/pocs/tree/main/gdal-swinqdims_bof) demonstrates the triggering mechanism.