Executive brief
OSGeo GDAL is a widely used library for processing and translating geospatial data formats. A security flaw in its HDF4-EOS data handler could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted data field name. This could impact the reliability of applications using GDAL for map processing or lead to unauthorized access on the local system.
Technical details
A heap-based buffer overflow exists in the GDnentries function within frmts/hdf4/hdf-eos/GDapi.c of OSGeo GDAL. The vulnerability is caused by an unbounded strcat operation on a caller-allocated buffer when processing the DataFieldName argument. A local attacker with low privileges can exploit this by manipulating input data to trigger the overflow. Successful exploitation could lead to a denial of service or arbitrary code execution in the context of the application using the library. The issue is addressed in version 3.13.0 and backported in patch 184f77dbcc74118c062c05e464c88161d3c37b9b.
Affected products
- OSGeo GDAL < 3.13.0
Timeline
- 2026-05-07: advisory: Initial disclosure and NVD publication
- 2026-05-12: patched: GitHub advisory updated with patch details