CVE-2026-8088 Details
Description
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.
A vulnerability allowing for an out-of-bounds read has been identified in OSGeo GDAL versions through 3.13.0dev-4. The issue arises in the HDF4-EOS handling, specifically within the GDfieldinfo function of the GDapi.c file. The vulnerability is triggered by a size_t underflow when the function processes the DimList metadata, leading to a read operation that exceeds the allocated buffer. This flaw can be exploited locally, causing a segmentation fault and a denial-of-service condition.
Users are advised to upgrade to GDAL version 3.13.0RC1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/biniamf/pocs/tree/main/gdal-gdapi-gdfinfo-dimlist-oob-read | [email protected] | ExploitThird Party Advisory |
| https://github.com/OSGeo/gdal/ | [email protected] | Product |
| https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c | [email protected] | Patch |
| https://github.com/OSGeo/gdal/issues/14379 | [email protected] | ExploitIssue TrackingPatchVendor Advisory |
| https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 | [email protected] | Release Notes |
| https://vuldb.com/submit/808040 | [email protected] | ExploitThird Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/361841 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/361841/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osgeo gdal | <= 3.12.4 3.13.0 beta1 3.13.0 beta2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | New CVE Received | [email protected] |