VulnerableCode Package Details - pkg:pypi/gdal@3.4.2

Search for packages

Vulnerability	Summary	Fixed by
VCID-1h42-g2r2-g3a2 Aliases: CVE-2026-8088 GHSA-j3f5-rw74-g4rv	A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.	3.13.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-3tzy-7gdx-f3gy Aliases: CVE-2026-8087 GHSA-h9rh-5ffh-h669	A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.	3.13.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-vpn7-bzcx-rucn Aliases: BIT-gdal-2026-49014 CVE-2026-49014 PYSEC-2026-193	In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.	3.13.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1h42-g2r2-g3a2
Aliases:
CVE-2026-8088
GHSA-j3f5-rw74-g4rv

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.

3.13.0
Affected by 1 other vulnerability.

VCID-3tzy-7gdx-f3gy
Aliases:
CVE-2026-8087
GHSA-h9rh-5ffh-h669

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.

3.13.0
Affected by 1 other vulnerability.

VCID-vpn7-bzcx-rucn
Aliases:
BIT-gdal-2026-49014
CVE-2026-49014
PYSEC-2026-193

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.

3.13.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-07T10:40:32.152542+00:00	GitLab Importer	Affected by	VCID-1h42-g2r2-g3a2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/GDAL/CVE-2026-8088.yml	38.6.0
2026-06-07T10:40:23.779509+00:00	GitLab Importer	Affected by	VCID-3tzy-7gdx-f3gy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/GDAL/CVE-2026-8087.yml	38.6.0
2026-06-05T17:05:34.426886+00:00	PyPI Importer	Affected by	VCID-vpn7-bzcx-rucn	https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip	38.6.0
2026-06-05T16:15:57.716947+00:00	Pypa Importer	Affected by	VCID-vpn7-bzcx-rucn	https://github.com/pypa/advisory-database/blob/main/vulns/gdal/PYSEC-2026-193.yaml	38.6.0