CVE-2026-8212: Heap-based Buffer Overflow in OSGeo gdal
A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.
AI Analysis
Technical Summary
This vulnerability involves a heap-based buffer overflow in the OSGeo gdal library, specifically in the SWSDfldsrch function of the HDF4 EOS format handler. The issue affects versions up to 3.13.0dev-4 and requires local access to exploit. The vulnerability allows an attacker with local privileges to manipulate inputs leading to a buffer overflow on the heap, potentially causing memory corruption or crashes. The vendor has released a patched version 3.13.0RC1 that resolves this flaw.
Potential Impact
Successful exploitation can lead to heap-based buffer overflow, which may cause application crashes or memory corruption. The attack requires local access, limiting remote exploitation. The CVSS 4.8 (medium) reflects the moderate risk due to the local attack vector and the potential impact on confidentiality, integrity, and availability at a low level.
Mitigation Recommendations
Upgrade affected OSGeo gdal versions to 3.13.0RC1 or later, which contains the official fix for this vulnerability. Since the patch is available, applying this update is the recommended remediation. No additional mitigations are specified.
CVE-2026-8212: Heap-based Buffer Overflow in OSGeo gdal
Description
A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.
CVSS v4.0
Score 4.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a heap-based buffer overflow in the OSGeo gdal library, specifically in the SWSDfldsrch function of the HDF4 EOS format handler. The issue affects versions up to 3.13.0dev-4 and requires local access to exploit. The vulnerability allows an attacker with local privileges to manipulate inputs leading to a buffer overflow on the heap, potentially causing memory corruption or crashes. The vendor has released a patched version 3.13.0RC1 that resolves this flaw.
Potential Impact
Successful exploitation can lead to heap-based buffer overflow, which may cause application crashes or memory corruption. The attack requires local access, limiting remote exploitation. The CVSS 4.8 (medium) reflects the moderate risk due to the local attack vector and the potential impact on confidentiality, integrity, and availability at a low level.
Mitigation Recommendations
Upgrade affected OSGeo gdal versions to 3.13.0RC1 or later, which contains the official fix for this vulnerability. Since the patch is available, applying this update is the recommended remediation. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-09T07:09:13.290Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69ffba6ccbff5d86108a8ace
Added to database: 05/09/2026, 22:51:24 UTC
Last enriched: 05/17/2026, 10:47:53 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.