EUVD-2026-28436
GHSA-j3f5-rw74-g4rv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local file system access
-
DeliveryCreate or place malformed HDF4 file
-
ExploitExecute GDAL tool or application reading HDF4
-
ExecutionTrigger GDfieldinfo parsing
-
PersistOut-of-bounds memory read
-
ImpactInformation disclosure or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attack requires: (1) Local access to the system (AV:L) or ability to place a file on the target system, (2) A user with at least standard privileges (PR:L) to execute GDAL tools or applications that process HDF4 files, and (3) A specially crafted HDF4 file with malformed field name metadata-specifically dimension list strings that do not conform to expected parenthetical structure or are less than 2 characters long. Exploitation does NOT require network access, special privileges, or user interaction (UI:N). The vulnerability is limited to systems with GDAL compiled with HDF4 support; builds without HDF4 driver are unaffected. Remote exploitation is NOT possible; an attacker must have local file system access or ability to influence HDF4 file contents. |
| Impact | CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N/VC:N/VI:N/VA:L) indicates this is a low-severity local information disclosure requiring authenticated access (PR:L), with impact limited to availability (VA:L, likely a crash). However, the 'E:P' field signals publicly available exploit code. The CVSS score of 1.9 reflects the minimal impact (no confidentiality or integrity impact), though information disclosure through out-of-bounds read remains possible. Real-world risk is further constrained by three limiting factors: (1) local-only attack vector requiring physical or authenticated access to the system, (2) requirement for a specially crafted HDF4 file, and (3) low-privilege user context. This is NOT a network-exploitable vulnerability. For organizations processing untrusted HDF4 files from external sources or via shared systems, the risk is moderate; for air-gapped or trusted-input-only deployments, risk is minimal. The presence of public POC code means casual exploitation is possible for those with local access, but widespread automated exploitation is unlikely given local-only requirement. |
| Exploit ScenarioDerived | An attacker with local user privileges creates or obtains a malformed HDF4 file with improperly formatted field name strings (missing or incomplete parenthetical markers). When a privileged user or application processes this file using GDAL's GDfieldinfo or SWfinfo functions, the vulnerable string parsing logic reads beyond the allocated buffer, potentially leaking sensitive memory contents or causing a denial-of-service crash. Public POC code on GitHub (biniamf/pocs) demonstrates this with crafted HDF4 test files (issue_14378.he4, issue_14379.he4). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 07, 2026
Out-of-bounds read in OSGeo GDAL up to version 3.13.0dev-4 affects the GDfieldinfo function in HDF-EOS module when processing malformed HDF4 files. A locally authenticated attacker can trigger memory disclosure by crafting a specially formatted HDF4 file. Publicly available exploit code exists. The vulnerability is fixed in GDAL 3.13.0RC1 and later.
RemediationAI
Upgrade OSGeo GDAL to version 3.13.0RC1 or later. The upstream commit a791f70f8eaec540974ec989ca6fb00266b7646c has been released in the v3.13.0RC1 tag. Organizations unable to upgrade immediately should restrict local system access to trusted users only and disable or isolate HDF4 file processing from untrusted sources. If HDF4 processing is not required, disabling the HDF4 driver at compile time (--without-hdf4) eliminates exposure entirely. A temporary workaround involves validating HDF4 files with an external tool before processing, though this is less reliable than patching. The patch involves minimal code changes (bounds checking before string manipulation) with no breaking API changes or performance impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the GDfieldinfo function of frmts/hdf4/hdf-eos/GDapi.c, which parses HDF-EOS metadata from HDF4 files. The function uses memmove and string manipulation to process dimension list strings without proper bounds checking. The vulnerable code attempts to strip parentheses from field name strings by performing a string length calculation and then shifting memory, but fails to validate that the string is at least 2 characters long and properly terminated before accessing array indices. This violates CWE-125 (Out-of-bounds Read), allowing reads beyond allocated buffer boundaries. The similar vulnerability pattern also exists in SWapi.c (SWfinfo function) and is patched identically. The fix adds explicit length validation before the memmove operation, ensuring the string has minimum length 2 and proper parenthetical structure.
Know when Gdal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exce
Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialRefe
A buffer overflow vulnerability in GDAL versions before 3.11.0 within the zlib infback9 module allows remote attackers t
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that
Arbitrary code execution in GDAL 3.1.0 through 3.13.0 arises from a stack-based buffer overflow in the netCDF driver's s
Heap-based buffer overflow in OSGeo GDAL up to version 3.13.0dev-4 allows local authenticated attackers to corrupt memor
Out-of-bounds read in OSGeo GDAL up to version 3.13.0dev-4 occurs in the HDF-EOS Grid File Handler when parsing malforme
Heap-based buffer overflow in OSGeo GDAL's Grid File Handler (GDSDfldsrch function in frmts/hdf4/hdf-eos/GDapi.c) affect
Heap-based buffer overflow in GDAL's HDF4-EOS SWSDfldsrch function (frmts/hdf4/hdf-eos/SWapi.c) allows local authenticat
Heap-based buffer overflow in OSGeo GDAL up to 3.13.0dev-4 within the SWnentries function of the HDF4-EOS module allows
Exploit-DB