Buffer overflow in Osgeo Gdal
CVE-2026-8088
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Osgeo Gdal — versions 3.13.0dev-4, 3.13.0RC1, 3.13.0
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (Exploit, VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Patch, Issue Tracking, Vendor Advisory)
- cna@vuldb.com (Exploit, Third Party Advisory, exploit)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Release Notes, patch)
- cna@vuldb.com (Product, product)
Frequently asked questions
- What is CVE-2026-8088?
- CVE-2026-8088 is a low-severity vulnerability in Osgeo Gdal, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 3.3/10. Published 2026-05-07.
- How severe is CVE-2026-8088?
- Low severity. CVSS v3 base score is 3.3 out of 10.