# CVE-2026-8087: OSGeo GDAL heap buffer overflow in HDF4-EOS driver

Source: https://junglewise.ai/threats/cve-2026-8087-osgeo-gdal-heap-buffer-overflow-in-hdf4-eos-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-8087 · Severity: medium · CVSS 5.3 · Published 2026-05-07

OSGeo GDAL is a widely used library for processing and translating geospatial data formats. A security flaw in its HDF4-EOS data handler could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted data field name. This could impact the reliability of applications using GDAL for map processing or lead to unauthorized access on the local system.

Technologies: [OSGeo Gdal](https://junglewise.ai/threats/technologies/osgeo-gdal), [GDAL (PyPI)](https://junglewise.ai/threats/technologies/gdal). Vendors: [OSGeo](https://junglewise.ai/threats/vendors/osgeo), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-8087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8087 being exploited in the wild.

**How severe is CVE-2026-8087?** Medium severity, with a CVSS score of 5.3, published 7 May 2026.

**Which products and versions are affected?** GDAL (PyPI) < 3.13.0, ECOSYSTEM:introduced=0,fixed=3.13.0.

**Is there a fix for CVE-2026-8087?** Yes. GDAL (PyPI): upgrade to 3.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8087 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-8087?** Check whether you run OSGeo Gdal or GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- GDAL (PyPI): upgrade to 3.13.0 or later

  ```sh
  pip install "GDAL>=3.13.0"
  ```


## Technical details

A heap-based buffer overflow exists in the GDnentries function within frmts/hdf4/hdf-eos/GDapi.c of OSGeo GDAL. The vulnerability is caused by an unbounded strcat operation on a caller-allocated buffer when processing the DataFieldName argument. A local attacker with low privileges can exploit this by manipulating input data to trigger the overflow. Successful exploitation could lead to a denial of service or arbitrary code execution in the context of the application using the library. The issue is addressed in version 3.13.0 and backported in patch 184f77dbcc74118c062c05e464c88161d3c37b9b.

## Affected products

- OSGeo GDAL < 3.13.0

## Identifiers

- CVE-2026-8087
- GHSA-h9rh-5ffh-h669
- PYSEC-2026-2155

## Timeline

- 2026-05-07: advisory: Initial disclosure and NVD publication
- 2026-05-12: patched: GitHub advisory updated with patch details

## References

- [https://github.com/OSGeo/gdal/issues/14363](https://github.com/OSGeo/gdal/issues/14363)
- [https://github.com/OSGeo/gdal/commit/184f77dbcc74118c062c05e464c88161d3c37b9b](https://github.com/OSGeo/gdal/commit/184f77dbcc74118c062c05e464c88161d3c37b9b)
- [https://github.com/OSGeo/gdal](https://github.com/OSGeo/gdal)
- [https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1](https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1)
- [https://github.com/biniamf/pocs/tree/main/gdal-gdinqfields_bof](https://github.com/biniamf/pocs/tree/main/gdal-gdinqfields_bof)

## Related threats

- [OSGeo GDAL stack buffer overflow in netCDF driver](https://junglewise.ai/threats/cve-2026-49014-osgeo-gdal-stack-buffer-overflow-in-netcdf-driver)
- [OSGeo GDAL heap buffer overflow in Grid File Handler](https://junglewise.ai/threats/cve-2026-8213-osgeo-gdal-heap-buffer-overflow-in-grid-file-handler)
- [OSGeo GDAL heap buffer overflow in SWSDfldsrch](https://junglewise.ai/threats/cve-2026-8212-osgeo-gdal-heap-buffer-overflow-in-swsdfldsrch)
- [OSGeo GDAL out-of-bounds read in GDfieldinfo](https://junglewise.ai/threats/cve-2026-8088-osgeo-gdal-out-of-bounds-read-in-gdfieldinfo)
- [A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file…](https://junglewise.ai/threats/cve-2026-8086-pysec-2026-2154-a-vulnerability-was-identified-in-osgeo-gdal-up-to)