PT-2026-38556 · Osgeo · Gdal

Biniam · Published 2026-05-07 · Updated 2026-05-11 · CVE-2026-8086

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OSGeo gdal versions prior to 3.12.4RC1

Description A heap-based buffer overflow occurs in the SWnentries() function within the frmts/hdf4/hdf-eos/SWapi.c file. This issue is triggered by the manipulation of the DimensionName argument and requires local access to be exploited.

Recommendations Upgrade to version 3.12.4RC1.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

BIT-GDAL-2026-8086

CVE-2026-8086

ECHO-D971-6867-258C

Affected Products

Gdal

References · 18

• 🔥 https://github.com/OSGeo/gdal/issues/14356 · Exploit
• 🔥 https://vuldb.com/submit/808038 · Exploit
• 🔥 https://github.com/biniamf/pocs/tree/main/gdal-swinqdims_bof · Exploit
• https://github.com/OSGeo/gdal/pull/14361 · Patch
• https://github.com/OSGeo/gdal/commit/9491e794f1757f08063ea2f7a274ad2994afa636 · Patch
• https://github.com/OSGeo/gdal/releases/tag/v3.12.4RC1 · Patch
• https://cve.org/CVERecord?id=CVE-2026-8086 · Security Note
• https://ubuntu.com/security/CVE-2026-8086 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-8086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8086 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8086 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gdal-2026-8086 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8086 · Vendor Advisory
• https://github.com/OSGeo/gdal · Note
• https://vuldb.com/vuln/361839 · Note