CVE-2026-4738: GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C.
This issue affects gdal: before 3.11.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4738?
CVE-2026-4738 is classified as a high-severity vulnerability due to its potential for heap corruption and remote code execution.
How do I fix CVE-2026-4738?
To mitigate CVE-2026-4738, users should upgrade to a patched version of GDAL beyond 3.11.0.
What systems are affected by CVE-2026-4738?
CVE-2026-4738 affects OSGeo GDAL versions up to but not including 3.11.0.
What type of vulnerability is CVE-2026-4738?
CVE-2026-4738 is an improper restriction of operations within the bounds of a memory buffer vulnerability.
What could happen if CVE-2026-4738 is exploited?
Exploitation of CVE-2026-4738 could lead to heap corruption and potentially allow an attacker to execute arbitrary code remotely.