ByteOS Network

CVE Vulnerability Details :

CVE-2026-8086

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-07 May, 2026 | 18:45

Updated At-07 May, 2026 | 19:53

▼CVE Numbering Authority (CNA)

OSGeo gdal SWapi.c SWnentries heap-based overflow

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.

Affected Products

Vendor

OSGeo

Product

gdal

CPEs

cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*

Versions

Affected

3.13.0dev-4

Unaffected

3.12.4RC1

Problem Types

Type	CWE ID	Description
CWE	CWE-122	Heap-based Buffer Overflow
CWE	CWE-119	Memory Corruption

Type: CWE

CWE ID: CWE-122

Description: Heap-based Buffer Overflow

Type: CWE

CWE ID: CWE-119

Description: Memory Corruption

Metrics

Version	Base score	Base severity	Vector
4.0	4.8	MEDIUM	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	5.3	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3.0	5.3	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2.0	4.3	N/A	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Version: 4.0

Base score: 4.8

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 3.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 2.0

Base score: 4.3

Base severity: N/A

Vector:

AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Credits

reporter

biniam (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-05-07 00:00:00
VulDB entry created	2026-05-07 02:00:00
VulDB entry last update	2026-05-07 14:39:32

Event: Advisory disclosed

Date: 2026-05-07 00:00:00

Event: VulDB entry created

Date: 2026-05-07 02:00:00

Event: VulDB entry last update

Date: 2026-05-07 14:39:32

References

Hyperlink	Resource
https://vuldb.com/vuln/361839	vdb-entry technical-description
https://vuldb.com/vuln/361839/cti	signature permissions-required
https://vuldb.com/submit/808038	third-party-advisory
https://github.com/OSGeo/gdal/issues/14356	issue-tracking
https://github.com/OSGeo/gdal/pull/14361	issue-tracking patch
https://github.com/biniamf/pocs/tree/main/gdal-swinqdims_bof	exploit
https://github.com/OSGeo/gdal/commit/9491e794f1757f08063ea2f7a274ad2994afa636	patch
https://github.com/OSGeo/gdal/releases/tag/v3.12.4RC1	patch
https://github.com/OSGeo/gdal/	product