CVE-2026-8084

OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds

CVSS 4.8 MEDIUMEPSS 0.3%CWE-119 CWE-125

Vexday Risk Score

33Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

CVSS 4.8EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Ciclo de vida

07 mai 2026Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

OSGeo · gdal

PoCs públicas encontradas — 2

cve_referencegithub.com/biniamf/pocs/blob/main/gdal_swfinfo_dimlist_oob-rwnão verificado cve_referencegithub.com/biniamf/pocs/tree/main/gdal_swfinfo_dimlist_oob-rwnão verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Referências

https://github.com/biniamf/pocs/blob/main/gdal_swfinfo_dimlist_oob-rw https://github.com/biniamf/pocs/tree/main/gdal_swfinfo_dimlist_oob-rw https://github.com/OSGeo/gdal/https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c https://github.com/OSGeo/gdal/issues/14378 https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 https://vuldb.com/submit/808034 https://vuldb.com/vuln/361838 https://vuldb.com/vuln/361838/cti