OSGeo GDAL CVE-2026-8213

Exploitation requires the following specific conditions: (1) GDAL library must be compiled with HDF4 support (Grid File Handler component enabled), (2) an authenticated local user or process with file read/write permissions must invoke a GDAL function that calls GDSDfldsrch (typically during HDF4 grid file reading/processing), (3) a specially crafted HDF4 file with malformed FieldList metadata (e.g., missing surrounding quotes or extremely short length) must be provided to GDAL. The vulnerability does NOT affect systems where HDF4 support is disabled in GDAL, systems that do not process HDF4 files, or systems without local user access. Remote exploitation is not possible (AV:L confirms local-only attack vector). Exploitation is limited to the context of HDF4 Grid File processing and does not affect other GDAL formats or non-spatial data processing. The CVSS indicates PR:L (low privilege required), meaning the attacking user must have login/local access but does not require administrative rights, however they must have file access permissions to invoke GDAL processing.

The risk assessment presents a complex picture requiring careful interpretation of conflicting signals. CVSS 4.0 vector (AV:L/AC:L/PR:L) indicates local attack vector requiring low privilege and low complexity, with low confidentiality/integrity/availability impact (VC:L/VI:L/VA:L)-all confidentiality impact marked as 'L' rather than 'H' suggests information disclosure rather than code execution potential. However, the vulnerability is classified as a heap-based buffer overflow, which traditionally carries exploitation for code execution. The low CVSS impact ratings (1.9 score) contradict the severity typically associated with heap overflows; this likely reflects the HDF4 processing context where reading a malformed file causes a crash rather than achieving reliable code execution. The publicly available POC and disclosure to the security community increase practical exploitation likelihood despite low CVSS. The AC:L (Low Complexity) rating indicates straightforward exploitation via a crafted HDF4 file. Exploitation requires local file access and an authenticated user with privileges to invoke GDAL HDF4 reading functions-this limits scope to system administrators, GIS analysts, or processes running with elevated privileges. The EPSS score is not provided; without it, real-world exploitation prevalence cannot be quantitatively assessed. KEV (CISA Known Exploited Vulnerabilities) status is not indicated in the provided data. CRITICAL CONFLICT: CWE-119 and 'heap-based buffer overflow' description suggest potential code execution risk, but CVSS impact ratings (VC:L/VI:L/VA:L, no IC/II/IA fields) indicate only low severity impact. Verify with vendor whether this is remote code execution potential or denial-of-service/information disclosure. The presence of public POC code substantially increases practical risk compared to the CVSS score alone.

An authenticated local user or administrator crafts a malicious HDF4 grid file (.he4) with a malformed FieldList metadata entry (missing or improperly formatted quotes). When a GDAL application or script invokes GDSDfldsrch to process the grid's field metadata, the unsafe string manipulation code writes out-of-bounds into heap memory. Depending on heap layout and memory contents, this can trigger a crash (denial of service) or, in specific conditions, allow reading or writing adjacent heap memory. A process running GIS analysis tools (QGIS, ArcGIS, or custom geospatial processing scripts) using the vulnerable GDAL library is exploited when such a file is passed to it.