Executive brief
GDAL is a widely used open-source library for processing geospatial and satellite data. A vulnerability in its HDF4-EOS data format handler could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted metadata file. This could disrupt operations or lead to unauthorized access on systems that automatically process geographic data.
Technical details
A heap-based buffer overflow exists in the SWSDfldsrch function within frmts/hdf4/hdf-eos/SWapi.c of OSGeo GDAL. The vulnerability is caused by an integer underflow when the code attempts to strip quotes from a metadata-derived string (FieldList) using memmove without verifying that the string length is at least two characters. When an empty string is processed, the length calculation wraps to a large value, leading to an out-of-bounds read/write. This requires local access to provide a malicious file for processing. The issue is addressed in version 3.13.0RC1 and commit 3e04c0385630e4d42517046d9a4967dfccfeb7fd.
Affected products
- OSGeo GDAL < 3.13.0RC1
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub
- 2026-05-09: advisory: NVD publication date
- 2026-05-10: advisory: GitHub Advisory published
- 2026-05-29: patched: GitHub Advisory reviewed and updated with patch info