Threats affecting pkg:github/osgeo/gdal

A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 3.13.0RC1 can resolve this issue. The identifier of the patch is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. It is suggested to upgrade the affected component.

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

CVE-2026-8088 is an out-of-bounds read vulnerability in the OSGeo gdal library affecting versions up to 3.13.0dev-4. The issue exists in the GDfieldinfo function within the file frmts/hdf4/hdf-eos/GDapi.c. Exploitation requires local access and can lead to reading memory outside intended bounds. A public exploit is available. Upgrading to version 3.13.0RC1 addresses the vulnerability.

CVE-2026-8087 is a heap-based buffer overflow vulnerability in the OSGeo gdal library up to version 3.13.0dev-4. The flaw exists in the GDnentries function within the file frmts/hdf4/hdf-eos/GDapi.c and can be triggered by manipulating the DataFieldName argument. Exploitation requires local access and no user interaction. A public exploit is available. Upgrading to version 3.13.0RC1 is recommended to address this issue.

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.

CVE-2026-8084 is an out-of-bounds read vulnerability in the OSGeo gdal library affecting versions up to 3.13.0dev-4. The flaw exists in the memmove function within the HDF-EOS Grid File Handler component. Exploitation requires local access and no user interaction is needed. A patch is available in version 3.13.0RC1 that resolves this issue.

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎. This issue affects gdal: before 3.11.0.