Executive brief
OSGeo GDAL is a widely used library for processing geospatial data formats. A vulnerability in its HDF4-EOS grid file handler allows a local attacker to crash applications that use the library by providing a specially crafted data file. This could lead to a denial-of-service (DoS) condition, impacting the availability of systems processing geographic information.
Technical details
A vulnerability exists in the GDSDfldsrch function within frmts/hdf4/hdf-eos/GDapi.c of OSGeo GDAL. The issue stems from an integer underflow when stripping quotes from a metadata-derived string. Specifically, the code calls memmove(name, name + 1, strlen(name) - 2) without verifying that the string length is at least 2. If the 'FieldList' metadata value is empty, the unsigned subtraction results in a massive value (SIZE_MAX-1), leading to an out-of-bounds read/write and a subsequent crash (SIGSEGV). This can be triggered locally via tools like gdalmdiminfo when processing a crafted HDF-EOS grid file. The issue is fixed in version 3.13.0RC1.
Affected products
- OSGeo gdal up to 3.13.0dev-4
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub
- 2026-05-04: patched: Version 3.13.0RC1 released
- 2026-05-09: advisory: CVE-2026-8213 published
References
- https://github.com/OSGeo/gdal/
- https://github.com/OSGeo/gdal/commit/3e04c0385630e4d42517046d9a4967dfccfeb7fd
- https://github.com/OSGeo/gdal/issues/14399
- https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1
- https://github.com/biniamf/pocs/tree/main/gdal-gdsdfldsrch_oob-read
- https://vuldb.com/submit/808128
- https://vuldb.com/vuln/362430