CVE-2026-49014

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OSGeo/gdal/issues/14594	Issue Tracking Mitigation Vendor Advisory
https://github.com/OSGeo/gdal/issues/14594	Issue Tracking Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-27 02:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-49014

Mitre link : CVE-2026-49014

CVE.ORG link : CVE-2026-49014

JSON object : View

Products Affected

osgeo

gdal

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-49014", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49014", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-27T13:51:40.806763Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "GDAL", "product": "GDAL", "versions": [{"status": "affected", "version": "3.1.0", "versionType": "semver", "lessThanOrEqual": "3.13.0"}], "defaultStatus": "unknown"}]}], "published": "2026-05-27T02:16:34.180", "references": [{"url": "https://github.com/OSGeo/gdal/issues/14594", "tags": ["Issue Tracking", "Mitigation", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/OSGeo/gdal/issues/14594", "tags": ["Issue Tracking", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp."}, {"lang": "es", "value": "En GDAL 3.1.0 hasta 3.13.0, scanForGeometryContainers en el controlador netCDF permite la ejecuci\u00f3n de c\u00f3digo mediante un desbordamiento de b\u00fafer basado en pila. Lee un atributo de geometr\u00eda en un b\u00fafer de pila de tama\u00f1o fijo sin validar la longitud del atributo. El atacante incrusta el exploit como un atributo de geometr\u00eda de tama\u00f1o excesivo en un archivo NetCDF manipulado. Esto logra la ejecuci\u00f3n de c\u00f3digo arbitrario en el servidor que ejecuta GDAL. Esto se encuentra en frmts/netcdf/netcdfsg.cpp."}], "lastModified": "2026-07-24T12:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "713930D5-3BA1-4B6D-8ECD-8748678646BE", "versionEndIncluding": "3.13.0", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}