CVE-2026-8084OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds

Descripción

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• VDB-361838 | OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
• VDB-361838 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-requiredPermissions RequiredVDB Entry
• Submit #808034 | OSGeo GDAL 3.13.0dev Out-of-Bounds Read third-party-advisoryExploitThird Party AdvisoryVDB Entry
• https://github.com/biniamf/pocs/tree/main/gdal_swfinfo_dimlist_oob-rw exploitExploitThird Party Advisory
• https://github.com/OSGeo/gdal/issues/14378 issue-trackingExploitIssue TrackingPatch
• https://github.com/biniamf/pocs/blob/main/gdal_swfinfo_dimlist_oob-rw exploitThird Party Advisory
• https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c patchPatch
• https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1 patchRelease Notes
• https://github.com/OSGeo/gdal/ productProduct