OSGeo GDAL EUVD-2026-28948

Exploitation requires: (1) Local file system access to place or upload a malformed HDF4 file that will be processed by GDAL; (2) GDAL must be compiled with HDF4 support enabled (the vulnerable SWapi.c and GDapi.c modules must be included); (3) The application must call gdal.Open() or equivalent HDF4-reading function on the malicious file; (4) Authenticated access to the system or application accepting the file (CVSS PR:L indicates low privilege, not unauthenticated). The vulnerability is triggered automatically when GDAL parses HDF4 metadata - no special GDAL configuration or feature enablement is required beyond HDF4 driver support. Non-default condition: HDF4 driver must be compiled in (many light-weight GDAL builds omit it). Limitation: Remote exploitation is NOT possible; attacker must have local access or ability to cause a local process to open the file.

CVSS 1.9 with AV:L/AC:L/PR:L indicates local, low-complexity, low-privilege exploitation with low confidentiality/integrity/availability impact - a ratings signal that contradicts the severity of heap buffer overflow. However, CVSS 4.0 shows E:P (exploit proof-of-concept exists), and the public exploit code corroborates this. The low impact scores (VC:L/VI:L/VA:L) likely reflect that the overflow is containable within the process or the attacker's ability to reliably convert memory corruption to code execution is limited. Real-world risk is moderate: the vulnerability requires local file access and authentication (PR:L), but GDAL is often used by server-side geospatial applications processing untrusted HDF4 uploads. An authenticated local user or a service processing malicious HDF4 files can crash the process (denial of service) or potentially escalate to code execution if memory layout permits. The patch is mature (RC1 release), and the PoC is public, creating urgency for patching. SSVC framing: Exploitation confirmed (PoC available), automatable (no user interaction required once file is processed), technical impact on integrity/availability (memory corruption). This should be high priority for systems accepting HDF4 file uploads.

An attacker creates a malformed HDF4 file with a crafted FieldList metadata attribute that either lacks proper quotes or is unusually short. When a local user or a server-side application (e.g., a geospatial data processing service) opens this file using GDAL, the SWSDfldsrch function attempts to parse the field list. The unvalidated memmove writes beyond the heap buffer allocated for the name variable, corrupting adjacent heap structures. This can crash the GDAL process (DoS) or, with carefully chosen heap layout and memory content, lead to information disclosure or code execution.