PT-2026-38555 · Osgeo · Gdal

Biniam · Published 2026-05-07 · Updated 2026-05-11 · CVE-2026-8084

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OSGeo gdal versions prior to 3.13.0RC1

Description An issue exists in the HDF-EOS Grid File Handler component within the memmove() function of the frmts/hdf4/hdf-eos/SWapi.c file. This flaw allows for an out-of-bounds read, which occurs when the system reads data outside the intended boundary of a buffer. This attack is restricted to local execution.

Recommendations Upgrade to version 3.13.0RC1.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

BIT-GDAL-2026-8084

CVE-2026-8084

ECHO-33EA-8335-42C0

Affected Products

Gdal

References · 18

• 🔥 https://github.com/biniamf/pocs/blob/main/gdal_swfinfo_dimlist_oob-rw · Exploit
• 🔥 https://vuldb.com/submit/808034 · Exploit
• 🔥 https://github.com/biniamf/pocs/tree/main/gdal_swfinfo_dimlist_oob-rw · Exploit
• https://github.com/OSGeo/gdal/issues/14378 · Vendor Advisory
• https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 · Patch
• https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8084 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8084 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gdal-2026-8084 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8084 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8084 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8084 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8084 · Vendor Advisory
• https://github.com/OSGeo/gdal · Note
• https://vuldb.com/vuln/361838 · Note