Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic stack-based buffer overflow within the netCDF driver of GDAL. The analysis of the patch commit f5ebabc1042f3c59b24e7c8ad45dda242d127f09 reveals that the core issue lies in reading netCDF attributes into fixed-size C-style character arrays on the stack without first verifying the size of the incoming attribute data. The function nc_get_att_text is used to read attribute data, but it does not perform bounds checking, writing past the end of the buffer if the source attribute is too large.
The vulnerability is explicitly mentioned for the function scanForGeometryContainers in the CVE description. The patch confirms this by replacing the vulnerable code, which uses a char c[NC_MAX_CHAR] buffer, with a call to a new safe function, NCDFGetAttr, that uses std::string for dynamic memory management. This prevents the overflow.
Furthermore, the same unsafe pattern was identified and fixed in the SGeometry_PropertyScanner::open function within the same file, frmts/netcdf/netcdfsg.cpp. This function was also reading the CF_SG_GEOMETRY attribute into a fixed-size stack buffer and is therefore also considered vulnerable to the same attack vector. The fix involves replacing multiple instances of this unsafe pattern with the newly introduced NCDFGetAttr helper function, which safely determines the attribute size before reading the data.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gdal | pip | >= 3.1.0, < 3.13.1 | 3.13.1 |
