CVE-2026-53877 is a buffer access vulnerability classified as CWE-805 in Django's GIS module. Specifically, the GDALRaster class over-reads its in-memory buffer when instantiated from a bytes object. This can lead to information disclosure of adjacent memory or service degradation through a segmentation fault upon accessing the vsi_buffer property. The vulnerability affects Django 6.0 versions prior to 6.0.7 and 5.2 versions prior to 5.2.16. Unsupported earlier versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. The issue was responsibly disclosed by Bence Nagy.

Successful exploitation can result in partial disclosure of adjacent memory contents or cause a denial of service due to a segmentation fault. The impact is limited to confidentiality and availability, with no integrity impact reported. The CVSS score of 4.8 reflects a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and unchanged scope.

A patch is available that fixes this vulnerability in Django versions 6.0.7 and 5.2.16. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation depends on applying the official Django updates. There is no indication that no action is required or that the issue is already mitigated without patching.