Quick answers
- Is CVE-2026-8088 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8088 being exploited in the wild.
- How severe is CVE-2026-8088?
- Low severity, with a CVSS score of 3.3, published 7 May 2026.
- Which products and versions are affected?
- GDAL (PyPI) < 3.13.0, ECOSYSTEM:introduced=0,fixed=3.13.0.
- Is there a fix for CVE-2026-8088?
- Yes. GDAL (PyPI): upgrade to 3.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-8088 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-8088?
- Check whether you run OSGeo Gdal or GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- GDAL (PyPI): upgrade to 3.13.0 or later
pip install "GDAL>=3.13.0"
Technical details
An out-of-bounds read exists in OSGeo GDAL's HDF4-EOS driver within the GDfieldinfo function in GDapi.c. The vulnerability is caused by a size_t underflow when the code attempts to strip parentheses from a 'DimList' metadata value using memmove. If the DimList string is empty or contains only a single character, the length calculation (strlen - 2) wraps to a very large value, causing an out-of-bounds read from the heap. An attacker can exploit this by providing a malformed HDF-EOS grid file to an application using GDAL, such as gdalmdiminfo. The issue is fixed in version 3.13.0 and backported in patch a791f70.
Affected products
- OSGeo GDAL < 3.13.0
Identifiers
- CVE-2026-8088
- GHSA-j3f5-rw74-g4rv
- PYSEC-2026-2156
Timeline
- 2026-04-16: disclosed: Issue reported on GitHub
- 2026-05-07: advisory: GitHub and NVD advisories published
- 2026-05-07: patched: Version 3.13.0 released