Medium severity5.3NVD Advisory· Published May 9, 2026· Updated May 19, 2026
CVE-2026-8212
CVE-2026-8212
Description
A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
GDALPyPI | < 3.13.0RC1 | 3.13.0RC1 |
Affected products
14- osv-coords9 versionspkg:apk/chainguard/py3.10-gdalpkg:apk/chainguard/py3.11-gdalpkg:apk/chainguard/py3.12-gdalpkg:apk/chainguard/py3.13-gdalpkg:apk/wolfi/py3.10-gdalpkg:apk/wolfi/py3.11-gdalpkg:apk/wolfi/py3.12-gdalpkg:apk/wolfi/py3.13-gdalpkg:bitnami/gdal
< 3.13.1-r0+ 8 more
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.1-r0
- (no CPE)range: < 3.13.0
Patches
Vulnerability mechanics
References
10- github.com/OSGeo/gdal/commit/3e04c0385630e4d42517046d9a4967dfccfeb7fdnvdPatchWEB
- github.com/OSGeo/gdal/releases/tag/v3.13.0RC1nvdPatchRelease NotesWEB
- github.com/OSGeo/gdal/issues/14398nvdExploitIssue TrackingMitigationPatchWEB
- github.com/biniamf/pocs/tree/main/gdal-swsdfldsrch_oob-readnvdExploitThird Party AdvisoryWEB
- vuldb.com/submit/808127nvdExploitThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-r5m4-5vww-w9f5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-8212ghsaADVISORY
- vuldb.com/vuln/362429nvdThird Party AdvisoryVDB EntryWEB
- github.com/pypa/advisory-database/tree/main/vulns/gdal/PYSEC-2026-4.yamlghsaWEB
- vuldb.com/vuln/362429/ctinvdPermissions RequiredVDB EntryWEB
News mentions
0No linked articles in our index yet.