Executive brief
GDAL is a widely used library for processing geographic and spatial data. A vulnerability was found where processing a specially crafted HDF-EOS grid file can cause the software to crash. This could lead to a denial-of-service condition, potentially disrupting operations that rely on automated geographic data processing.
Technical details
An out-of-bounds read exists in OSGeo GDAL's HDF4-EOS driver within the GDfieldinfo function in GDapi.c. The vulnerability is caused by a size_t underflow when the code attempts to strip parentheses from a 'DimList' metadata value using memmove. If the DimList string is empty or contains only a single character, the length calculation (strlen - 2) wraps to a very large value, causing an out-of-bounds read from the heap. An attacker can exploit this by providing a malformed HDF-EOS grid file to an application using GDAL, such as gdalmdiminfo. The issue is fixed in version 3.13.0 and backported in patch a791f70.
Affected products
- OSGeo GDAL < 3.13.0
Timeline
- 2026-04-16: disclosed: Issue reported on GitHub
- 2026-05-07: advisory: GitHub and NVD advisories published
- 2026-05-07: patched: Version 3.13.0 released