1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8212

CVE-2026-8212: OSGeo gdal has a heap-based buffer overflow

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch commit sha is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8212

CVE-2026-8212:

1.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
GDAL	pip	< 3.13.0RC1	3.13.0RC1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap-based buffer overflow in the GDAL library when parsing HDF4-EOS metadata. The analysis of the provided patch commit 3e04c0385630e4d42517046d9a4967dfccfeb7fd reveals modifications to two functions: SWSDfldsrch in frmts/hdf4/hdf-eos/SWapi.c and GDSDfldsrch in frmts/hdf4/hdf-eos/GDapi.c. Both functions were modified to fix the same logical flaw. Before the patch, both functions would fetch a 'FieldList' metadata string and attempt to remove leading and trailing quotes by performing a memmove operation. The code incorrectly assumed the string would always be at least two characters long and properly quoted. When processing a crafted file containing a 'FieldList' with a length less than two, the calculation strlen(name) - 2 would result in a large positive integer due to size_t underflow. This would cause memmove to read and write a large amount of data beyond the bounds of the allocated buffer name, leading to a heap-based buffer overflow. The patch mitigates this by adding checks to ensure the string length is sufficient and that it is indeed quoted before attempting the memmove operation. Therefore, both SWSDfldsrch and GDSDfldsrch are identified as the vulnerable functions.

Vulnerable functions

SWSDfldsrch

frmts/hdf4/hdf-eos/SWapi.c

The function `SWSDfldsrch` is vulnerable to a heap-based buffer overflow. It reads a metadata field list into a buffer `name` and attempts to remove quotes from it. The vulnerability occurs because the code does not validate the length of the string in `name` before performing a `memmove` operation. If the string is less than two characters long, `strlen(name) - 2` will underflow, causing `memmove` to read and write out of bounds, leading to a crash or potential code execution.

GDSDfldsrch

frmts/hdf4/hdf-eos/GDapi.c

The function `GDSDfldsrch` has a heap-based buffer overflow vulnerability identical to the one in `SWSDfldsrch`. It processes a metadata field list and attempts to unquote it without proper bounds checking. An attacker could provide a crafted HDF4 file with a short or non-quoted 'FieldList' metadata value, triggering an out-of-bounds read and write during the `memmove` operation, which can lead to denial of service or other memory corruption-related impacts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.