Is CVE-2026-8087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8087 being exploited in the wild.

How severe is CVE-2026-8087?

Medium severity, with a CVSS score of 5.3, published 7 May 2026.

Which products and versions are affected?

GDAL (PyPI) < 3.13.0, ECOSYSTEM:introduced=0,fixed=3.13.0.

Is there a fix for CVE-2026-8087?

Yes. GDAL (PyPI): upgrade to 3.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8087 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-8087?

Check whether you run OSGeo Gdal or GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8087: OSGeo GDAL heap buffer overflow in HDF4-EOS driver

Q: Which products and versions are affected?

GDAL (PyPI) < 3.13.0, ECOSYSTEM:introduced=0,fixed=3.13.0.

Q: Is there a fix for CVE-2026-8087?

Yes. GDAL (PyPI): upgrade to 3.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8087 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-8087?

Check whether you run OSGeo Gdal or GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8087 · Severity: medium · CVSS 5.3 · Published 2026-05-07

OSGeo GDAL is a widely used library for processing and translating geospatial data formats. A security flaw in its HDF4-EOS data handler could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted data field name. This could impact the reliability of applications using GDAL for map processing or lead to unauthorized access on the local system.

Technologies: OSGeo Gdal, GDAL (PyPI). Vendors: OSGeo, PyPI.

Quick answers

Is CVE-2026-8087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8087 being exploited in the wild.
How severe is CVE-2026-8087?: Medium severity, with a CVSS score of 5.3, published 7 May 2026.
Which products and versions are affected?: GDAL (PyPI) < 3.13.0, ECOSYSTEM:introduced=0,fixed=3.13.0.
Is there a fix for CVE-2026-8087?: Yes. GDAL (PyPI): upgrade to 3.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8087 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-8087?: Check whether you run OSGeo Gdal or GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

GDAL (PyPI): upgrade to 3.13.0 or later
```
pip install "GDAL>=3.13.0"
```

Technical details

A heap-based buffer overflow exists in the GDnentries function within frmts/hdf4/hdf-eos/GDapi.c of OSGeo GDAL. The vulnerability is caused by an unbounded strcat operation on a caller-allocated buffer when processing the DataFieldName argument. A local attacker with low privileges can exploit this by manipulating input data to trigger the overflow. Successful exploitation could lead to a denial of service or arbitrary code execution in the context of the application using the library. The issue is addressed in version 3.13.0 and backported in patch 184f77dbcc74118c062c05e464c88161d3c37b9b.

Affected products

OSGeo GDAL < 3.13.0

Identifiers

CVE-2026-8087
GHSA-h9rh-5ffh-h669
PYSEC-2026-2155

Timeline

2026-05-07: advisory: Initial disclosure and NVD publication
2026-05-12: patched: GitHub advisory updated with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.