CVE-2026-8212

OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow

CVSS 4.8 MEDIUMEPSS 0.2%CWE-119 CWE-122

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 4.8EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

09 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

OSGeo · gdal

public PoCs found — 1

cve_referencegithub.com/biniamf/pocs/tree/main/gdal-swsdfldsrch_oob-readunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/biniamf/pocs/tree/main/gdal-swsdfldsrch_oob-read https://github.com/OSGeo/gdal/https://github.com/OSGeo/gdal/commit/3e04c0385630e4d42517046d9a4967dfccfeb7fd https://github.com/OSGeo/gdal/issues/14398 https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 https://vuldb.com/submit/808127 https://vuldb.com/vuln/362429 https://vuldb.com/vuln/362429/cti