Executive brief
GDAL, a widely used library for processing geospatial data, contains a vulnerability in its netCDF file driver. An attacker could provide a specially crafted data file that, when opened by a server or application using GDAL, allows them to execute unauthorized code. This could lead to a full system compromise, data theft, or service disruption.
Technical details
A stack-based buffer overflow exists in GDAL's netCDF driver within the `scanForGeometryContainers` function in `frmts/netcdf/netcdfsg.cpp`. The vulnerability is caused by reading a geometry attribute into a fixed-size stack buffer using `nc_get_att_text()` without first validating the attribute's length. An attacker can exploit this by embedding an oversized geometry attribute in a malicious NetCDF file. While the attack vector is local, it requires no specific privileges or user interaction beyond the library attempting to parse the file. The issue is addressed in version 3.13.1 by implementing length checks before reading attributes.
Affected products
- OSGeo GDAL 3.1.0 - 3.13.0
Timeline
- 2026-05-17: disclosed: Issue reported to OSGeo/gdal GitHub repository
- 2026-05-18: patched: Fix merged into master branch
- 2026-05-27: advisory: GitHub Advisory and NVD entry published