Logo
›
›vulnerability›CVE-2026-8087
Name
CVE-2026-8087
Source
NVD ( link)Debian ( link)
Description
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
CWEs
CWE-119
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/OSGeo/gdal/Product
https://github.com/OSGeo/gdal/commit/184f77dbcc74118c062c05e464c88161d3c37b9bPatch
https://github.com/OSGeo/gdal/issues/14363Exploit
https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1Release Notes
https://github.com/biniamf/pocs/tree/main/gdal-gdinqfields_bofExploit
https://vuldb.com/submit/808039Exploit
https://vuldb.com/vuln/361840VDB Entry
https://vuldb.com/vuln/361840/ctiPermissions Required

Analysis#

Affected Component
Analysis
gdal
Exploitable

Vulnerability Ratings#

1.9
CVSSv4
5.3
CVSSv31
7.8
CVSSv31
4.3
CVSSv2
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
gdal
buildroot
2025.02.x
3.8.2
Exploitable