CVE-2026-8087: OSGeo gdal GDapi.c GDnentries heap-based overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OSGeo gdalto a version that resolves this vulnerability.Fixed in 3.13.0RC1Patch 184f77dbcc74118c062c05e464c88161d3c37b9b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8087?
CVE-2026-8087 is considered a critical severity vulnerability due to its potential to cause a heap-based buffer overflow.
How do I fix CVE-2026-8087?
To fix CVE-2026-8087, update OSGeo GDAL to a version later than 3.13.0dev-4.
What software is affected by CVE-2026-8087?
CVE-2026-8087 affects OSGeo GDAL versions up to and including 3.13.0dev-4.
What impact does CVE-2026-8087 have on systems?
CVE-2026-8087 can lead to a heap-based buffer overflow, allowing for potential remote code execution.
Who is responsible for addressing CVE-2026-8087?
Maintainers and users of OSGeo GDAL are responsible for addressing CVE-2026-8087 by applying the necessary updates.