CVE-2026-8086CWE-119CWE-122

OSGeo gdal SWapi.c SWnentries heap-based overflow

Medium · published May 7, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
17.6
In the wild
Unconfirmed
What it is

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00266 · 17.6th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-122 · Heap-based Buffer Overflow
Published
2026-05-07T18:45Z
EPSS history
Timeline
  • 07 MAY 18:45Z
    OSGeo gdal SWapi.c SWnentries heap-based overflow
    cvelistv5