BIT-gdal-2026-8088

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/gdal/BIT-gdal-2026-8088.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-gdal-2026-8088
Aliases
Published
2026-05-11T05:39:29Z
Modified
2026-09-10T16:01:31Z
Summary
OSGeo gdal GDapi.c GDfieldinfo out-of-bounds
Details

A weakness has been identified in OSGeo gdal up to 3.13.0. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / gdal

Package

Name
gdal
Purl
pkg:bitnami/gdal

Severity

  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.13.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/gdal/BIT-gdal-2026-8088.json"