CVE-2026-8086

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8086
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8086.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8086
Aliases
Downstream
Published
2026-05-07T18:45:13.165Z
Modified
2026-07-13T07:26:30.884888597Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
OSGeo gdal SWapi.c SWnentries heap-based overflow
Details

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.13.0dev-4"
                },
                {
                    "last_affected": "3.13.0dev-4"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8086.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ]
}
References

Affected packages

Git / github.com/osgeo/gdal

Affected ranges

Type
GIT
Repo
https://github.com/osgeo/gdal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
dd0742a208c40fc31293dd94f976d5ce4d01500f
Fixed
9491e794f1757f08063ea2f7a274ad2994afa636
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:osgeo:gdal:3.13.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:osgeo:gdal:3.13.0:beta2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.12.4"
        },
        {
            "introduced": "3.13.0-beta1"
        },
        {
            "last_affected": "3.13.0-beta1"
        },
        {
            "introduced": "3.13.0-beta2"
        },
        {
            "last_affected": "3.13.0-beta2"
        }
    ]
}

Affected versions

2.*
2.4.4
3.*
3.0.3
3.13.0-beta1
3.13.0-beta2
v2.*
v2.3.0beta1
v2.4.0
v3.*
v3.1.0RC1
v3.11.0beta1
v3.12.0RC1
v3.12.0beta0
v3.12.0beta1
v3.12.0rc0
v3.12.1
v3.12.1RC1
v3.12.2
v3.12.2RC1
v3.12.3
v3.12.3RC1
v3.12.3RC2
v3.3.0
v3.3.0RC1
v3.3.0beta1
v3.5.0RC1
v3.6.0RC1
v3.8.0RC1
v3.8.0beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8086.json"