Log in Start free

Vulnerability · Published May 7, 2026 · Assigned by VulDB

CVE-2026-8088OSGeo gdal GDapi.c GDfieldinfo out-of-bounds

Low 3.3

In plain English

A low-severity out-of-bounds read in gdal from OSGeo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 84.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gdalno fix listedDEBIAN-CVE-2026-8088
Debian:13gdalno fix listedDEBIAN-CVE-2026-8088
Debian:14gdal3.13.0+dfsg-1DEBIAN-CVE-2026-8088
PyPIgdal3.13.0GHSA-j3f5-rw74-g4rv
PyPIgdal3.13.0PYSEC-2026-2156
Ubuntu:25.10gdalno fix listedUBUNTU-CVE-2026-8088

Affected products (as reported)

VendorProductVersions
OSGeo gdal 3.13.0dev-4

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References