1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8087

CVE-2026-8087: OSGeo GDAL vulnerable to heap-based buffer overflow

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8087

CVE-2026-8087:

1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
GDAL	pip	< 3.13.0	3.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap-based buffer overflow in the GDAL library, specifically within the HDF4-EOS driver. The analysis of the provided patch (commit 184f77dbcc74118c062c05e464c88161d3c37b9b) pinpoints the exact location of the flaw. The GDnentries function in frmts/hdf4/hdf-eos/GDapi.c was responsible for calculating the size of a buffer to hold metadata. The code incorrectly assumed that a metadata string would always be quoted, and unconditionally subtracted 2 from the string length. This created an integer underflow scenario if an unquoted string was passed, leading to a smaller-than-required buffer allocation. When the application then tried to copy the metadata string into this undersized buffer, a heap-based buffer overflow would occur. The patch rectifies this by adding a condition to only subtract 2 from the length if the string is indeed quoted. Therefore, any runtime profile during the exploitation of this vulnerability would show the GDnentries function in the call stack, as it is the function that contains the vulnerable code.

Vulnerable functions

GDnentries

frmts/hdf4/hdf-eos/GDapi.c

The vulnerability exists in the `GDnentries` function, which calculates the buffer size for metadata entries. The original code incorrectly assumed that the metadata string `utlstr` would always be enclosed in double quotes and subtracted 2 from its length. An attacker could provide a crafted `DataFieldName` without quotes, causing the function to miscalculate the buffer size, leading to a heap-based buffer overflow when the data is later written.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.