CVE-2026-49014: Buffer Overflow
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49014?
CVE-2026-49014 has a severity rating of high, with a score of 7.4.
How do I fix CVE-2026-49014?
To fix CVE-2026-49014, you should update GDAL to a version beyond 3.13.0 that addresses the buffer overflow vulnerability.
What systems are affected by CVE-2026-49014?
CVE-2026-49014 affects GDAL versions from 3.1.0 to 3.13.0.
What is the risk associated with CVE-2026-49014?
The risk associated with CVE-2026-49014 is considered moderate to high due to potential for code execution via buffer overflow.
How does CVE-2026-49014 allow code execution?
CVE-2026-49014 allows code execution through a stack-based buffer overflow by reading an oversized geometry attribute into a fixed-size stack buffer.