CVE-2026-8084: osgeo gdal
Vulnerability summary
CVE-2026-8084 is a medium (CVSS 5.5) vulnerability in osgeo gdal. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 07-05-2026PublishedVulnerability first disclosed.
- 08-05-2026Last modifiedVulnerability information updated.
Description
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.
CVSS metrics
11 scores · 5 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CDiffers
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
-0.04 pp
From 0.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundPocs
Maturity: poc
Gdal
Maturity: poc
Exploit Reference (vuldb.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Debian1 product
- gdalAll versions (No fix recorded) | < 3.13.0+dfsg-1
Osgeo1 product
- gdal3.13.0dev-4 | ≤ 3.12.4 | 3.13.0:beta1 | 3.13.0:beta2
PyPI1 product
- gdal< 3.13.0
Ubuntu1 product
- gdal< 1.10.1+dfsg-5ubuntu1+esm3 | < 1.11.3+dfsg-3ubuntu0.1~esm2 | < 2.2.3+dfsg-2ubuntu0.1~esm1 | < 3.0.4+dfsg-1ubuntu0.1~esm1 | < 3.4.1+dfsg-1ubuntu0.1~esm1 | < 3.8.4+dfsg-3ubuntu3+esm1 | All versions (No fix recorded) | < 3.12.2+dfsg-1ubuntu0.1~esm1
4 vendors · 4 products
