Log in Start free

Vulnerability · Published May 9, 2026 · Assigned by VulDB

CVE-2026-8212OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in gdal from OSGeo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 89.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gdalno fix listedDEBIAN-CVE-2026-8212
Debian:13gdalno fix listedDEBIAN-CVE-2026-8212
Debian:14gdal3.13.0+dfsg-1DEBIAN-CVE-2026-8212
PyPIgdal3.13.0RC1GHSA-r5m4-5vww-w9f5
PyPIgdalno fix listedPYSEC-2026-4
Ubuntu:25.10gdalno fix listedUBUNTU-CVE-2026-8212

Affected products (as reported)

VendorProductVersions
OSGeo gdal 3.13.0dev-4

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References