CVE-2026-8087

May 7, 2026, 8:32 p.m.

1.9
Low

Description

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.

Product(s) Impacted

Vendor Product Versions
Osgeo
  • Gdal
  • *, 3.13.0RC1

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a osgeo gdal / 3.13.0dev-4 / / / / / /
a osgeo gdal 3.13.0RC1 / / / / / /

References

https://github.com/OSGeo/gdal/
https://github.com/OSGeo/gdal/commit/184f77dbcc74118c062c05e464c88161d3c37b9b
https://github.com/OSGeo/gdal/issues/14363
https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1
https://github.com/biniamf/pocs/tree/main/gdal-gdinqfields_bof
https://vuldb.com/submit/808039
https://vuldb.com/vuln/361840
https://vuldb.com/vuln/361840/cti

Tags

CWE-119
[email protected]
2026-05-07
CVE-2026-8087

CVSS Score

1.9 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: LOW
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: May 7, 2026, 8:16 p.m.
Last Modified: May 7, 2026, 8:32 p.m.

Status : Undergoing Analysis

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.