Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

GDAL HDF‑EOS Grid Handler can read beyond memory

CVE-2026-8084 · published 6 months ago
Summary

The GDAL library versions up to 3.13.0dev-4 have a coding error in the HDF‑EOS Grid file handler that can cause it to read data outside its intended area. This can be triggered by a program running on the same machine and may expose internal information. Updating GDAL to version 3.13.0RC1 (or later) resolves the issue; apply the latest package from your distribution.

What to do
  • Update gdal to version 3.13.0.
  • Update canonical gdal to version 1.10.1+dfsg-5ubuntu1+esm3.
  • Update canonical gdal to version 1.11.3+dfsg-3ubuntu0.1~esm2.
  • Update canonical gdal to version 2.2.3+dfsg-2ubuntu0.1~esm1.
  • Update canonical gdal to version 3.0.4+dfsg-1ubuntu0.1~esm1.
  • Update canonical gdal to version 3.4.1+dfsg-1ubuntu0.1~esm1.
  • Update canonical gdal to version 3.8.4+dfsg-3ubuntu3+esm1.
  • Update canonical gdal to version 3.12.2+dfsg-1ubuntu0.1~esm1.
  • Update debian gdal to version 3.13.0+dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian gdal All versions
Debian:12 debian gdal All versions
Debian:13 debian gdal All versions
Debian:14 debian gdal < 3.13.0+dfsg-1
Fix: upgrade to 3.13.0+dfsg-1
– osgeo gdal <= 3.12.4
3.13.0
cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*
Ubuntu:Pro:14.04:LTS canonical gdal < 1.10.1+dfsg-5ubuntu1+esm3
Fix: upgrade to 1.10.1+dfsg-5ubuntu1+esm3
Ubuntu:16.04:LTS canonical gdal All versions
Ubuntu:18.04:LTS canonical gdal All versions
Ubuntu:20.04:LTS canonical gdal All versions
Ubuntu:22.04:LTS canonical gdal All versions
Ubuntu:24.04:LTS canonical gdal All versions
Ubuntu:25.10 canonical gdal All versions
Ubuntu:26.04:LTS canonical gdal All versions
Bitnami – gdal < 3.13.0
Fix: upgrade to 3.13.0
Ubuntu:Pro:16.04:LTS canonical gdal < 1.11.3+dfsg-3ubuntu0.1~esm2
Fix: upgrade to 1.11.3+dfsg-3ubuntu0.1~esm2
Ubuntu:Pro:18.04:LTS canonical gdal < 2.2.3+dfsg-2ubuntu0.1~esm1
Fix: upgrade to 2.2.3+dfsg-2ubuntu0.1~esm1
Ubuntu:Pro:20.04:LTS canonical gdal < 3.0.4+dfsg-1ubuntu0.1~esm1
Fix: upgrade to 3.0.4+dfsg-1ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS canonical gdal < 3.4.1+dfsg-1ubuntu0.1~esm1
Fix: upgrade to 3.4.1+dfsg-1ubuntu0.1~esm1
Ubuntu:Pro:24.04:LTS canonical gdal < 3.8.4+dfsg-3ubuntu3+esm1
Fix: upgrade to 3.8.4+dfsg-3ubuntu3+esm1
Ubuntu:Pro:26.04:LTS canonical gdal < 3.12.2+dfsg-1ubuntu0.1~esm1
Fix: upgrade to 3.12.2+dfsg-1ubuntu0.1~esm1
Original advisory text
OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-125Out-of-bounds Read
Timeline
Published7 May 2026
Updated4 Nov 2026
First seen7 May 2026
Sources
CVE-2026-8084 · NVD
DEBIAN-CVE-2026-8084 · OSV
UBUNTU-CVE-2026-8084 · OSV
BIT-gdal-2026-8084 · OSV
CVE-2026-8084 · OSV
Track software like this
Free during beta