JLSEC-2026-767

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-767.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-767.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-767
Upstream
  • EUVD-2026-28417
  • GHSA-jmvp-7877-wr2f
Published
2026-07-15T21:25:44.755Z
Modified
2026-07-25T18:24:01.947272575Z
Severity
  • 1.7 (Low) CVSS_V2 - AV:L/AC:L/Au:S/C:N/I:N/A:P CVSS Calculator
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4
Details

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.

Database specific 
{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8084",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-8084",
            "modified": "2026-06-17T11:03:27.940Z",
            "id": "CVE-2026-8084",
            "imported": "2026-07-17T22:38:35.705Z",
            "published": "2026-05-07T19:16:02.950Z",
            "database_specific": {
                "status": "Analyzed"
            }
        },
        {
            "html_url": "https://github.com/advisories/GHSA-jmvp-7877-wr2f",
            "modified": "2026-05-07T21:30:36Z",
            "published": "2026-05-07T21:30:29Z",
            "imported": "2026-07-17T22:38:35.867Z",
            "id": "GHSA-jmvp-7877-wr2f",
            "url": "https://api.github.com/advisories/GHSA-jmvp-7877-wr2f"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28417",
            "modified": "2026-05-08T22:53:55Z",
            "published": "2026-05-07T18:30:13Z",
            "imported": "2026-07-17T22:38:45.758Z",
            "id": "EUVD-2026-28417",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-28417"
        }
    ],
    "license": "CC-BY-4.0"
}
References

Affected packages

Julia / GDAL_jll

Package

Name
GDAL_jll
Purl
pkg:julia/GDAL_jll?uuid=a7073274-a066-55f0-b90d-d619367d196c

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
305.1300.0+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-767.json"