CVE-2026-53877CWE-805

Heap buffer over-read in GDALRaster

Medium · published July 7, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.

`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Bence Nagy for reporting this issue.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00437 · 36.7th percentile
Weakness
CWE-805 · Buffer Access with Incorrect Length Value
Published
2026-07-07T14:10Z
EPSS history
Timeline
  • 07 JUL 14:10Z
    Heap buffer over-read in GDALRaster
    cvelistv5