CVE-2026-8212

MediumCVSS 5.5/10Last modified Jul 24, 2026

Description

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-122 CWE-125

Affected software

Vendor	Product	Versions
OSGeo	gdal	3.13.0dev-4

References

https://github.com/OSGeo/gdal/Product
https://github.com/OSGeo/gdal/commit/3e04c0385630e4d42517046d9a4967dfccfeb7fdPatch
https://github.com/OSGeo/gdal/issues/14398Exploit, Issue Tracking, Mitigation, Patch
https://github.com/OSGeo/gdal/releases/tag/v3.13.0RC1Patch, Release Notes
https://github.com/biniamf/pocs/tree/main/gdal-swsdfldsrch_oob-readExploit, Third Party Advisory
https://vuldb.com/submit/808127Exploit, Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362429Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362429/ctiPermissions Required, VDB Entry

Timeline

Published: May 9, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-821209.8Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Ve CVE-2026-821217.5Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Versi CVE-2026-821229.4Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server V CVE-2026-821236.5Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.CVE-2026-821245.3The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including CVE-2026-821255.3The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a CVE-2026-821262.7The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they CVE-2026-821273.5The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields CVE-2026-82135.5A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hd CVE-2026-82145.3A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. This affects the function doAction of the component RMI In CVE-2026-82155.3A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This vulnerability affects the function iasRequestFil CVE-2026-821532.2Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attack