Is CVE-2026-8212 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8212 being exploited in the wild.

How severe is CVE-2026-8212?

Medium severity, with a CVSS score of 5.3, published 9 May 2026.

Which products and versions are affected?

GDAL (PyPI) < 3.13.0RC1, ECOSYSTEM:introduced=0,fixed=3.13.0RC1.

Is there a fix for CVE-2026-8212?

Yes. GDAL (PyPI): upgrade to 3.13.0RC1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8212 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-8212?

Check whether you run GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8212: OSGeo GDAL heap buffer overflow in SWSDfldsrch

Q: Which products and versions are affected?

GDAL (PyPI) < 3.13.0RC1, ECOSYSTEM:introduced=0,fixed=3.13.0RC1.

Q: Is there a fix for CVE-2026-8212?

Yes. GDAL (PyPI): upgrade to 3.13.0RC1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8212 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-8212?

Check whether you run GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8212 · Severity: medium · CVSS 5.3 · Published 2026-05-09

GDAL is a widely used open-source library for processing geospatial and satellite data. A vulnerability in its HDF4-EOS data format handler could allow a local attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted metadata file. This could disrupt operations or lead to unauthorized access on systems that automatically process geographic data.

Technologies: GDAL (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-8212 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8212 being exploited in the wild.
How severe is CVE-2026-8212?: Medium severity, with a CVSS score of 5.3, published 9 May 2026.
Which products and versions are affected?: GDAL (PyPI) < 3.13.0RC1, ECOSYSTEM:introduced=0,fixed=3.13.0RC1.
Is there a fix for CVE-2026-8212?: Yes. GDAL (PyPI): upgrade to 3.13.0RC1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8212 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-8212?: Check whether you run GDAL (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

GDAL (PyPI): upgrade to 3.13.0RC1 or later
```
pip install "GDAL>=3.13.0RC1"
```

Technical details

A heap-based buffer overflow exists in the SWSDfldsrch function within frmts/hdf4/hdf-eos/SWapi.c of OSGeo GDAL. The vulnerability is caused by an integer underflow when the code attempts to strip quotes from a metadata-derived string (FieldList) using memmove without verifying that the string length is at least two characters. When an empty string is processed, the length calculation wraps to a large value, leading to an out-of-bounds read/write. This requires local access to provide a malicious file for processing. The issue is addressed in version 3.13.0RC1 and commit 3e04c0385630e4d42517046d9a4967dfccfeb7fd.

Affected products

OSGeo GDAL < 3.13.0RC1

Identifiers

CVE-2026-8212
GHSA-r5m4-5vww-w9f5
PYSEC-2026-4

Timeline

2026-04-20: disclosed: Issue reported on GitHub
2026-05-09: advisory: NVD publication date
2026-05-10: advisory: GitHub Advisory published
2026-05-29: patched: GitHub Advisory reviewed and updated with patch info

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.