CVE-2026-8088

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8088
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8088.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8088
Aliases
Downstream
Related
Published
2026-05-07T19:30:11.704Z
Modified
2026-07-13T07:26:20.840377268Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
OSGeo gdal GDapi.c GDfieldinfo out-of-bounds
Details

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.

Database specific 
{
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.13.0dev-4"
                },
                {
                    "last_affected": "3.13.0dev-4"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8088.json"
}
References

Affected packages

Git / github.com/osgeo/gdal

Affected ranges

Type
GIT
Repo
https://github.com/osgeo/gdal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
dd0742a208c40fc31293dd94f976d5ce4d01500f
Fixed
a791f70f8eaec540974ec989ca6fb00266b7646c
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.12.4"
        },
        {
            "introduced": "3.13.0-beta1"
        },
        {
            "last_affected": "3.13.0-beta1"
        },
        {
            "introduced": "3.13.0-beta2"
        },
        {
            "last_affected": "3.13.0-beta2"
        }
    ],
    "cpe": [
        "cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:osgeo:gdal:3.13.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:osgeo:gdal:3.13.0:beta2:*:*:*:*:*:*"
    ]
}

Affected versions

3.*
3.13.0-beta1
3.13.0-beta2
v3.*
v3.13.0beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8088.json"