CVE-2026-8088: OSGeo gdal GDapi.c GDfieldinfo out-of-bounds
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OSGeo gdalto a version that resolves this vulnerability.Fixed in 3.13.0RC1Patch a791f70f8eaec540974ec989ca6fb00266b7646c
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8088?
CVE-2026-8088 is classified as a high severity vulnerability due to its potential for causing out-of-bounds read conditions.
What software versions are affected by CVE-2026-8088?
CVE-2026-8088 affects OSGeo GDAL versions up to 3.13.0dev-4, including beta versions 3.13.0-beta1 and 3.13.0-beta2.
How do I fix CVE-2026-8088?
To mitigate CVE-2026-8088, you should upgrade to the latest stable version of OSGeo GDAL that is unaffected by this vulnerability.
Can CVE-2026-8088 be exploited remotely?
No, CVE-2026-8088 requires local access to exploit, meaning the attack must be executed on the same system.
What could happen if CVE-2026-8088 is exploited?
Exploitation of CVE-2026-8088 could lead to information disclosure via an out-of-bounds read, potentially exposing sensitive data.