CVE-2026-8212

MEDIUM5.3EPSS 0.02%

OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow

發布日:2026/5/9修改日:2026/5/29

也稱為:GHSA-r5m4-5vww-w9f5BIT-gdal-2026-8212PYSEC-2026-4

描述

A flaw has been found in OSGeo gdal up to 3.13.0. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

受影響套件(3)

Bitnami/gdalfrom 0, < 3.13.0
PyPI/gdalfrom 0, < 3.13.0RC1
PyPI/gdal

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

描述

受影響套件(3)

CVSS 分數

參考連結(11)