CVE-2026-53877 is a medium-severity vulnerability in Django's GIS component where the GDALRaster class over-reads its in-memory buffer when instantiated from a bytes object. This improper buffer access occurs upon accessing the vsi_buffer property, potentially leaking adjacent memory contents or causing a segmentation fault that degrades service availability. The vulnerability affects Django versions 5.2 before 5.2.16 and 6.0 before 6.0.7. No official remediation level or patch links are provided in the available data. Earlier unsupported versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated for this issue.

The vulnerability can lead to information disclosure through adjacent memory leakage or cause service degradation via segmentation faults when the vulnerable property is accessed. This impacts confidentiality and availability but does not affect integrity. The CVSS 3.1 base score is 4.8 (medium), reflecting network attack vector with high attack complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the official Django vendor advisory for current remediation guidance. Until a patch is available, avoid using the vulnerable GDALRaster functionality with untrusted bytes objects or accessing the vsi_buffer property. Monitor Django's official security announcements for updates and apply official fixes once released.