CVE catalog
CVE-2026-8084
A vulnerability was determined in OSGeo gdal up to…
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.
- Severity
- High · CVSS 7.4
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.26% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "gdal",
"status": "fixed",
"release": "sid",
"version": "3.13.3+dfsg-2"
},
{
"name": "gdal",
"status": "fixed",
"release": "forky",
"version": "3.13.3+dfsg-2"
},
{
"name": "gdal",
"status": "vulnerable",
"release": "trixie",
"version": "3.10.3+dfsg-1"
},
{
"name": "gdal",
"status": "vulnerable",
"release": "bookworm",
"version": "3.6.2+dfsg-1"
}
],
"fixed_versions": [
{
"bug": 1135997,
"name": "gdal",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "3.13.0+dfsg-1"
},
{
"bug": 1135997,
"name": "gdal",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "3.13.0+dfsg-1"
},
{
"bug": 1135997,
"name": "gdal",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": 1135997,
"name": "gdal",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "gdal",
"ecosystem": "cpe",
"fixed_version": "not yet fixed"
},
{
"name": "gdal",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "gdal",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "gdal-bin",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "gdal-data",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "gdal-plugins",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "libgdal-dev",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "libgdal34t64",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "python3-gdal",
"distro": "ubuntu",
"ranges": [
{
"fixed": "3.8.4+dfsg-3ubuntu3+esm1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "3.8.4+dfsg-3ubuntu3+esm1"
},
{
"name": "gdal",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.2+dfsg-1ubuntu0.1~esm1"
}
]
}
],
"release": "pro",
"versions": [
"3.10.3+dfsg-1build2",
"3.10.3+dfsg-1build3",
"3.11.4+dfsg-1",
"3.12.0+dfsg-1",
"3.12.1+dfsg-1",
"3.12.2+dfsg-1",
"3.12.2+dfsg-1build1",
"3.12.2+dfsg-1build2"
],
"ecosystem": "deb",
"fixed_version": "3.12.2+dfsg-1ubuntu0.1~esm1",
"provider_record_id": "UBUNTU-CVE-2026-8084"
},
{
"name": "gdal",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "25.10",
"versions": [
"3.10.2+dfsg-1build3",
"3.10.3+dfsg-1",
"3.10.3+dfsg-1build1",
"3.10.3+dfsg-1build2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-8084"
},
{
"name": "gdal",
"ranges": [],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-8084"
}
]
}Publisher notes
[trixie] gdal: Minor issue [bookworm] gdal: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [gdal-bin]Unknown
Source package: [gdal]
Details (2)
3.6.2+dfsg-1+b2· amd64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
3.6.2+dfsg-1+b2· arm64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
- [gdal-data]Unknown
Source package: [gdal]
Details (2)
3.6.2+dfsg-1· all · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
3.6.2+dfsg-1· all · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
- [gdal-plugins]Unknown
Source package: [gdal]
Details (2)
3.6.2+dfsg-1+b2· amd64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
3.6.2+dfsg-1+b2· arm64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
- [libgdal32]Unknown
Source package: [gdal]
Details (2)
3.6.2+dfsg-1+b2· amd64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
3.6.2+dfsg-1+b2· arm64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
- [libgdal-dev]Unknown
Source package: [gdal]
Details (2)
3.6.2+dfsg-1+b2· amd64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
3.6.2+dfsg-1+b2· arm64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
- [python3-gdal]Unknown
Source package: [gdal]
Details (2)
3.6.2+dfsg-1+b2· amd64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
3.6.2+dfsg-1+b2· arm64 · bookwormAffected
nvd · gdal · debian · bookworm; nvd · gdal · debian · 12
[Debian 13 (Trixie)]
- [gdal-bin]Unknown
Source package: [gdal]
Details (2)
3.10.3+dfsg-1· amd64 · trixieAffected
nvd · gdal · debian · 13
3.10.3+dfsg-1· arm64 · trixieAffected
nvd · gdal · debian · 13
- [gdal-data]Unknown
Source package: [gdal]
Details (2)
3.10.3+dfsg-1· all · trixieAffected
nvd · gdal · debian · 13
3.10.3+dfsg-1· all · trixieAffected
nvd · gdal · debian · 13
- [gdal-plugins]Unknown
Source package: [gdal]
Details (2)
3.10.3+dfsg-1· amd64 · trixieAffected
nvd · gdal · debian · 13
3.10.3+dfsg-1· arm64 · trixieAffected
nvd · gdal · debian · 13
- [libgdal36]Unknown
Source package: [gdal]
Details (2)
3.10.3+dfsg-1· amd64 · trixieAffected
nvd · gdal · debian · 13
3.10.3+dfsg-1· arm64 · trixieAffected
nvd · gdal · debian · 13
- [libgdal-dev]Unknown
Source package: [gdal]
Details (2)
3.10.3+dfsg-1· amd64 · trixieAffected
nvd · gdal · debian · 13
3.10.3+dfsg-1· arm64 · trixieAffected
nvd · gdal · debian · 13
- [python3-gdal]Unknown
Source package: [gdal]
Details (2)
3.10.3+dfsg-1· amd64 · trixieAffected
nvd · gdal · debian · 13
3.10.3+dfsg-1· arm64 · trixieAffected
nvd · gdal · debian · 13
Observed:
References
- [https://github.com/OSGeo/gdal/]
- [https://github.com/OSGeo/gdal/commit/a791f70f8eaec540974ec989ca6fb00266b7646c]
- [https://github.com/OSGeo/gdal/issues/14378]
- [https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1]
- [https://github.com/biniamf/pocs/blob/main/gdal_swfinfo_dimlist_oob-rw]
- [https://github.com/biniamf/pocs/tree/main/gdal_swfinfo_dimlist_oob-rw]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-8084]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-8084]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-8084]
- [https://security-tracker.debian.org/tracker/CVE-2026-8084]
- [https://ubuntu.com/security/notices/USN-8812-1]
- [https://vuldb.com/submit/808034]
- [https://vuldb.com/vuln/361838]
- [https://vuldb.com/vuln/361838/cti]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]