CVE-2026-8084
Severity CVSS v4.0:
LOW
Type:
CWE-119
Buffer Errors
Publication date:
07/05/2026
Last modified:
08/05/2026
Description
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.
Impact
Base Score 4.0
1.90
Severity 4.0
LOW
Base Score 3.x
3.30
Severity 3.x
LOW
Base Score 2.0
1.70
Severity 2.0
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:* | 3.12.4 (including) | |
| cpe:2.3:a:osgeo:gdal:3.13.0:beta1:*:*:*:*:*:* | ||
| cpe:2.3:a:osgeo:gdal:3.13.0:beta2:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/OSGeo/gdal/
- https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c
- https://github.com/OSGeo/gdal/issues/14378
- https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1
- https://github.com/biniamf/pocs/blob/main/gdal_swfinfo_dimlist_oob-rw
- https://github.com/biniamf/pocs/tree/main/gdal_swfinfo_dimlist_oob-rw
- https://vuldb.com/submit/808034
- https://vuldb.com/vuln/361838
- https://vuldb.com/vuln/361838/cti