Threat database

A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 3.13.0RC1 can resolve this issue. The identifier of the patch is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. It is suggested to upgrade the affected component.

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

CVE-2026-8088 is an out-of-bounds read vulnerability in the OSGeo gdal library affecting versions up to 3.13.0dev-4. The issue exists in the GDfieldinfo function within the file frmts/hdf4/hdf-eos/GDapi.c. Exploitation requires local access and can lead to reading memory outside intended bounds. A public exploit is available. Upgrading to version 3.13.0RC1 addresses the vulnerability.

CVE-2026-8087 is a heap-based buffer overflow vulnerability in the OSGeo gdal library up to version 3.13.0dev-4. The flaw exists in the GDnentries function within the file frmts/hdf4/hdf-eos/GDapi.c and can be triggered by manipulating the DataFieldName argument. Exploitation requires local access and no user interaction. A public exploit is available. Upgrading to version 3.13.0RC1 is recommended to address this issue.

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.

CVE-2026-8084 is an out-of-bounds read vulnerability in the OSGeo gdal library affecting versions up to 3.13.0dev-4. The flaw exists in the memmove function within the HDF-EOS Grid File Handler component. Exploitation requires local access and no user interaction is needed. A patch is available in version 3.13.0RC1 that resolves this issue.

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎. This issue affects gdal: before 3.11.0.

EPSS 0.4%VulnerabilityOSGeo#cwe-119United States+11

CVE-2025-58360 is a high-severity XML External Entity (XXE) vulnerability affecting GeoServer, an open-source server for sharing geospatial data. This vulnerability allows attackers to exploit XML parsers to read arbitrary files, cause denial of service, or potentially execute remote code. Although no known exploits are currently active in the wild, the vulnerability poses significant risks to organizations relying on GeoServer for geospatial data services. European organizations using GeoServer in critical infrastructure, government, or environmental monitoring could face data breaches or service disruptions. Mitigation requires disabling external entity processing in XML parsers, applying patches once available, and restricting network access to GeoServer instances. Countries with high adoption of geospatial technologies and critical infrastructure reliance on GeoServer, such as Germany, France, the UK, and the Netherlands, are most at risk. Given the ease of exploitation without authentication and the potential impact on confidentiality and availability, this vulnerability is assessed as high severity. Defenders should prioritize vulnerability scanning, configuration audits, and network segmentation to reduce exposure.

KEVEPSS 60%VulnerabilityOSGeo#netsec#redditGermany+6

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

OSGeo GeoServer JAI-EXT contains a code injection vulnerability (CVE-2022-24816) that can lead to remote code execution when Jiffle scripts are accepted via network requests in programs using jt-jiffle. This vulnerability has been exploited in the wild and is considered high severity.