CVE-2026-8212

OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow

State: Published
Severity: 4.8 Medium
Published: May 9, 2026
Updated: May 11, 2026
Reserved: May 9, 2026

Description

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-122 Heap-based Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
gdalOSGeo	3.13.0dev-4Affected 3.13.0RC1Not affected

References

VDB-362429 | OSGeo gdal SWapi.c SWSDfldsrch heap-based overflowvdb-entrytechnical-description
VDB-362429 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #808127 | OSGeo GDAL 3.13.0dev Out-of-Bounds Readthird-party-advisory
https://github.com/OSGeo/gdal/issues/14398issue-tracking
https://github.com/biniamf/pocs/tree/main/gdal-swsdfldsrch_oob-readexploit
https://github.com/OSGeo/gdal/commit/3e04c0385630e4d42517046d9a4967dfccfeb7fdpatch
https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1patch
https://github.com/OSGeo/gdal/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.