OSGeo gdal has a heap-based buffer overflow

中 5.5CVE-2026-8212 · BIT-gdal-2026-8212 · GHSA-r5m4-5vww-w9f5 · 09/05/2026 公開 · 24/07/2026 更新

要点

CVE-2026-8212 は gdal, gdal (osgeo) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.21%（全脆弱性の 10.5% より高い）。
対処：3.13.0RC1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
gdal PyPI	`< 3.13.0RC1`	`3.13.0RC1`
gdal osgeo	`= 3.13.0≤ 3.12.4`	修正版なし

概要

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch commit sha is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

NVD の説明

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

参考情報

nvd.nist.gov/vuln/detail/CVE-2026-8212 · ADVISORY
OSGeo/gdal · WEB
OSGeo/gdal commit 3e04c03 · WEB
OSGeo/gdal · PACKAGE
OSGeo/gdal release v3.13.0RC1 · WEB
biniamf/pocs · WEB
pypa/advisory-database · WEB
vuldb.com/submit/808127 · WEB
vuldb.com/vuln/362429 · WEB
vuldb.com/vuln/362429/cti · WEB
OSGeo/gdal · Product
GitHub Advisory GHSA-r5m4-5vww-w9f5 · ADVISORY

gdal のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

gdal

PyPI

< 3.13.0RC1

3.13.0RC1

gdal

osgeo

= 3.13.0≤ 3.12.4

修正版なし

概要

NVD の説明

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

gdal のその他の脆弱性

すべて見る →