CVE-2026-8087
OSGeo gdal GDapi.c GDnentries heap-based overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
OSGeo gdal GDapi.c GDnentries heap-based overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
CVE-2026-8087- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 4.3
AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-122, CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2026-28435
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
EUVD-2026-28435- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h9rh-5ffh-h669
OSGeo GDAL vulnerable to heap-based buffer overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
GHSA-h9rh-5ffh-h669- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
NVD
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
CVE-2026-8087- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.3 Medium
AV:L/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-119, CWE-122
- Updated
- 2026-11-02
OSV
OSGeo gdal GDapi.c GDnentries heap-based overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
CVE-2026-8087- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119, CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-8087
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
DEBIAN-CVE-2026-8087- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-h9rh-5ffh-h669
OSGeo GDAL vulnerable to heap-based buffer overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
GHSA-h9rh-5ffh-h669- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVJLSEC-2026-769
OSGeo GDAL vulnerable to heap-based buffer overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
JLSEC-2026-769- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 2.0
- 4.3 Medium
AV:L/AC:L/Au:S/C:P/I:P/A:P - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4169
gdal security update
Geospatial Data Abstraction Library (GDAL/OGR) is a cross platform C++ translator library for raster and vector geospatial data formats. As a library, it presents a single abstract data model to the calling application for all supported formats. It also comes with a variety of useful commandline utilities for data translation and processing.
Security Fix(es):
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.(CVE-2026-8084)
A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.(CVE-2026-8086)
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.(CVE-2026-8087)
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.(CVE-2026-8088)
A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.(CVE-2026-8212)
A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 3.13.0RC1 can resolve this issue. The identifier of the patch is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. It is suggested to upgrade the affected component.(CVE-2026-8213)
- Record
OESA-2026-4169- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4170
gdal security update
Geospatial Data Abstraction Library (GDAL/OGR) is a cross platform C++ translator library for raster and vector geospatial data formats. As a library, it presents a single abstract data model to the calling application for all supported formats. It also comes with a variety of useful commandline utilities for data translation and processing.
Security Fix(es):
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.13.0RC1 is able to resolve this issue. Patch name: a791f70f8eaec540974ec989ca6fb00266b7646c. Upgrading the affected component is advised.(CVE-2026-8084)
A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.(CVE-2026-8086)
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.(CVE-2026-8087)
A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.13.0RC1 is sufficient to fix this issue. This patch is called a791f70f8eaec540974ec989ca6fb00266b7646c. The affected component should be upgraded.(CVE-2026-8088)
A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue. This patch is called 3e04c0385630e4d42517046d9a4967dfccfeb7fd. The affected component should be upgraded.(CVE-2026-8212)
A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 3.13.0RC1 can resolve this issue. The identifier of the patch is 3e04c0385630e4d42517046d9a4967dfccfeb7fd. It is suggested to upgrade the affected component.(CVE-2026-8213)
- Record
OESA-2026-4170- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2026-2155
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
PYSEC-2026-2155- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-8087
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
UBUNTU-CVE-2026-8087- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVAZL-86229 No score
CVE-2026-8087 affecting package gdal 3.6.3-2
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0RC1 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
AZL-86229- Updated
- 2026-11-02
OSVBIT-gdal-2026-8087 No score
OSGeo gdal GDapi.c GDnentries heap-based overflow
A security flaw has been discovered in OSGeo gdal up to 3.13.0. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.13.0 is recommended to address this issue. The patch is named 184f77dbcc74118c062c05e464c88161d3c37b9b. You should upgrade the affected component.
- Record
BIT-gdal-2026-8087- Updated
- 2026-11-02
OSVUSN-8812-1 No score
gdal vulnerabilities
It was discovered that GDAL incorrectly handled certain netCDF files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-49014)
It was discovered that GDAL incorrectly handled certain HDF-EOS files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2026-8086, CVE-2026-8087, CVE-2026-8212, CVE-2026-8213)
It was discovered that GDAL incorrectly handled certain HDF-EOS file metadata. An attacker could possibly use this issue to cause GDAL to crash, resulting in a denial of service. (CVE-2026-8084, CVE-2026-8088)
- Record
USN-8812-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gdalPyPI |
before 3.13.0 | 3.13.0 |
gdalAzure Linux:3 |
through 3.6.3-2 | None known |
gdalBitnami |
before 3.13.0 | 3.13.0 |
gdalDebian:12 |
All versions, plus listed versions 3.10.0+dfsg-13.10.0+dfsg-1~exp13.10.0~beta1+dfsg-1~exp13.10.0~rc1+dfsg-1~exp13.10.0~rc2+dfsg-1~exp1 Show 45 moreShow less3.10.0~rc3+dfsg-1~exp13.10.1+dfsg-13.10.1~rc1+dfsg-1~exp13.10.1~rc2+dfsg-1~exp13.10.2+dfsg-13.10.2~rc1+dfsg-1~exp13.10.3+dfsg-13.10.3+dfsg-23.10.3~rc1+dfsg-1~exp13.11.0+dfsg-1~exp13.11.0~beta1+dfsg-1~exp13.11.0~beta1+dfsg-1~exp23.11.0~rc1+dfsg-1~exp13.11.0~rc1+dfsg-1~exp23.11.0~rc2+dfsg-1~exp13.11.1+dfsg-1~exp13.11.1~rc1+dfsg-1~exp13.11.1~rc2+dfsg-1~exp13.11.2+dfsg-1~exp13.11.2~rc1+dfsg-1~exp13.11.2~rc2+dfsg-1~exp13.11.3+dfsg-13.11.3+dfsg-1~exp13.11.3+dfsg-1~exp23.11.4+dfsg-13.11.4~rc1+dfsg-1~exp13.12.0+dfsg-13.12.0+dfsg-1~exp13.12.0~beta1+dfsg-1~exp13.12.0~rc1+dfsg-1~exp13.12.1+dfsg-13.12.1~rc1+dfsg-1~exp13.12.2+dfsg-13.12.2~rc1+dfsg-1~exp13.12.3+dfsg-13.12.3~rc1+dfsg-1~exp13.12.3~rc2+dfsg-1~exp13.13.0+dfsg-13.13.0+dfsg-1~exp13.13.0~beta1+dfsg-1~exp13.13.0~beta2+dfsg-1~exp13.13.0~rc1+dfsg-1~exp13.13.0~rc2+dfsg-1~exp13.13.1+dfsg-13.13.1~rc1+dfsg-1~exp1 |
None known |
gdalDebian:13 |
All versions, plus listed versions 3.10.3+dfsg-13.10.3+dfsg-23.11.0+dfsg-1~exp13.11.0~beta1+dfsg-1~exp13.11.0~beta1+dfsg-1~exp2 Show 38 moreShow less3.11.0~rc1+dfsg-1~exp13.11.0~rc1+dfsg-1~exp23.11.0~rc2+dfsg-1~exp13.11.1+dfsg-1~exp13.11.1~rc1+dfsg-1~exp13.11.1~rc2+dfsg-1~exp13.11.2+dfsg-1~exp13.11.2~rc1+dfsg-1~exp13.11.2~rc2+dfsg-1~exp13.11.3+dfsg-13.11.3+dfsg-1~exp13.11.3+dfsg-1~exp23.11.4+dfsg-13.11.4~rc1+dfsg-1~exp13.12.0+dfsg-13.12.0+dfsg-1~exp13.12.0~beta1+dfsg-1~exp13.12.0~rc1+dfsg-1~exp13.12.1+dfsg-13.12.1~rc1+dfsg-1~exp13.12.2+dfsg-13.12.2~rc1+dfsg-1~exp13.12.3+dfsg-13.12.3~rc1+dfsg-1~exp13.12.3~rc2+dfsg-1~exp13.13.0+dfsg-13.13.0+dfsg-1~exp13.13.0~beta1+dfsg-1~exp13.13.0~beta2+dfsg-1~exp13.13.0~rc1+dfsg-1~exp13.13.0~rc2+dfsg-1~exp13.13.1+dfsg-13.13.1~rc1+dfsg-1~exp13.13.2+dfsg-13.13.2~rc1+dfsg-1~exp13.13.3+dfsg-13.13.3+dfsg-23.13.3~rc1+dfsg-1~exp1 |
None known |
gdalDebian:14 |
before 3.13.0+dfsg-1, plus listed versions 3.10.3+dfsg-13.10.3+dfsg-23.11.0+dfsg-1~exp13.11.0~beta1+dfsg-1~exp13.11.0~beta1+dfsg-1~exp2 Show 30 moreShow less3.11.0~rc1+dfsg-1~exp13.11.0~rc1+dfsg-1~exp23.11.0~rc2+dfsg-1~exp13.11.1+dfsg-1~exp13.11.1~rc1+dfsg-1~exp13.11.1~rc2+dfsg-1~exp13.11.2+dfsg-1~exp13.11.2~rc1+dfsg-1~exp13.11.2~rc2+dfsg-1~exp13.11.3+dfsg-13.11.3+dfsg-1~exp13.11.3+dfsg-1~exp23.11.4+dfsg-13.11.4~rc1+dfsg-1~exp13.12.0+dfsg-13.12.0+dfsg-1~exp13.12.0~beta1+dfsg-1~exp13.12.0~rc1+dfsg-1~exp13.12.1+dfsg-13.12.1~rc1+dfsg-1~exp13.12.2+dfsg-13.12.2~rc1+dfsg-1~exp13.12.3+dfsg-13.12.3~rc1+dfsg-1~exp13.12.3~rc2+dfsg-1~exp13.13.0+dfsg-1~exp13.13.0~beta1+dfsg-1~exp13.13.0~beta2+dfsg-1~exp13.13.0~rc1+dfsg-1~exp13.13.0~rc2+dfsg-1~exp1 |
3.13.0+dfsg-1 |
gdalPyPI |
before 3.13.0, plus listed versions 1.10.01.11.01.11.11.11.21.5.0 Show 45 moreShow less1.5.21.6.01.6.11.7.01.7.11.8.11.9.01.9.12.0.02.0.12.1.02.1.32.2.02.2.12.2.22.2.32.2.42.3.02.3.12.3.22.3.32.4.02.4.22.4.32.4.43.0.03.0.13.0.23.0.33.0.43.1.03.1.13.1.23.1.33.1.43.10.03.10.13.10.23.10.33.11.03.11.13.11.23.11.33.11.43.11.5 |
3.13.0 |
GDAL_jllJulia |
before 305.1300.0+0 | 305.1300.0+0 |
gdalopenEuler:24.03-LTS-SP3 |
before 3.10.1-5.oe2403sp3 | 3.10.1-5.oe2403sp3 |
gdalopenEuler:24.03-LTS-SP4 |
before 3.10.1-5.oe2403sp4 | 3.10.1-5.oe2403sp4 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gdalUbuntu:Pro:14.04:LTS |
before 1.10.1+dfsg-5ubuntu1+esm3, plus listed versions 1.9.0-3.1ubuntu41.9.0-3.1ubuntu61.10.1+dfsg-21.10.1+dfsg-2build11.10.1+dfsg-3 Show 7 moreShow less1.10.1+dfsg-3build11.10.1+dfsg-3build21.10.1+dfsg-3ubuntu11.10.1+dfsg-3ubuntu21.10.1+dfsg-5ubuntu11.10.1+dfsg-5ubuntu1+esm11.10.1+dfsg-5ubuntu1+esm2 |
1.10.1+dfsg-5ubuntu1+esm3 |
gdalUbuntu:Pro:16.04:LTS |
before 1.11.3+dfsg-3ubuntu0.1~esm2, plus listed versions 1.11.2+dfsg-3ubuntu31.11.2+dfsg-3ubuntu41.11.3+dfsg-2build11.11.3+dfsg-2build21.11.3+dfsg-2build3 Show 4 moreShow less1.11.3+dfsg-31.11.3+dfsg-3build11.11.3+dfsg-3build21.11.3+dfsg-3ubuntu0.1~esm1 |
1.11.3+dfsg-3ubuntu0.1~esm2 |
gdalUbuntu:Pro:18.04:LTS |
before 2.2.3+dfsg-2ubuntu0.1~esm1, plus listed versions 2.2.1+dfsg-2build32.2.1+dfsg-2build52.2.2+dfsg-2build12.2.3+dfsg-12.2.3+dfsg-2 |
2.2.3+dfsg-2ubuntu0.1~esm1 |
gdalUbuntu:Pro:20.04:LTS |
before 3.0.4+dfsg-1ubuntu0.1~esm1, plus listed versions 2.4.2+dfsg-1build22.4.2+dfsg-1build42.4.2+dfsg-22.4.3+dfsg-13.0.4+dfsg-13.0.4+dfsg-1build13.0.4+dfsg-1build23.0.4+dfsg-1build3 |
3.0.4+dfsg-1ubuntu0.1~esm1 |
gdalUbuntu:Pro:22.04:LTS |
before 3.4.1+dfsg-1ubuntu0.1~esm1, plus listed versions 3.2.2+dfsg-3ubuntu23.4.0+dfsg-13.4.1+dfsg-13.4.1+dfsg-1build13.4.1+dfsg-1build33.4.1+dfsg-1build4 |
3.4.1+dfsg-1ubuntu0.1~esm1 |
gdalUbuntu:Pro:24.04:LTS |
before 3.8.4+dfsg-3ubuntu3+esm1, plus listed versions 3.7.1+dfsg-1build13.8.0+dfsg-13.8.1+dfsg-1build13.8.2+dfsg-13.8.3+dfsg-13.8.4+dfsg-13.8.4+dfsg-3ubuntu23.8.4+dfsg-3ubuntu3 |
3.8.4+dfsg-3ubuntu3+esm1 |
gdalUbuntu:25.10 |
All versions, plus listed versions 3.10.2+dfsg-1build33.10.3+dfsg-13.10.3+dfsg-1build13.10.3+dfsg-1build2 |
None known |
gdalUbuntu:Pro:26.04:LTS |
before 3.12.2+dfsg-1ubuntu0.1~esm1, plus listed versions 3.10.3+dfsg-1build23.10.3+dfsg-1build33.11.4+dfsg-13.12.0+dfsg-13.12.1+dfsg-13.12.2+dfsg-13.12.2+dfsg-1build13.12.2+dfsg-1build2 |
3.12.2+dfsg-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8087 is a medium vulnerability (CVSS 4.8) in Osgeo Gdal, published May 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in gdal 3.13.0.
References
vuldb.com/vuln/361840
github.com/OSGeo/gdal/issues/14363
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-8087
security-tracker.debian.org/tracker/CVE-2026-8087
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4169
ubuntu.com/security/CVE-2026-8087
cve.org/CVERecord?id=CVE-2026-8087
Left out here: 103 versions. The JSON record has them.