{"id":"CVE-2026-49014","aliases":["AZL-88380","BIT-gdal-2026-49014","DEBIAN-CVE-2026-49014","EUVD-2026-32039","GHSA-wphc-7cm7-8mf7","JLSEC-2026-766","PYSEC-2026-193","UBUNTU-CVE-2026-49014","USN-8812-1"],"status":"published","title":"GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00102,"percentile":0.00938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-05-27T01:39:18Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"gdal","fixed_in":["3.13.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"gdal","fixed_in":["3.13.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gdal","fixed_in":["3.13.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"GDAL_jll","fixed_in":["305.1300.100+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gdal","fixed_in":["3.4.1+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gdal","fixed_in":["3.8.4+dfsg-3ubuntu3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gdal","fixed_in":["3.12.2+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.13.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"gdal","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.13.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0+dfsg-1","3.10.0+dfsg-1~exp1","3.10.0~beta1+dfsg-1~exp1","3.10.0~rc1+dfsg-1~exp1","3.10.0~rc2+dfsg-1~exp1","3.10.0~rc3+dfsg-1~exp1","3.10.1+dfsg-1","3.10.1~rc1+dfsg-1~exp1","3.10.1~rc2+dfsg-1~exp1","3.10.2+dfsg-1","3.10.2~rc1+dfsg-1~exp1","3.10.3+dfsg-1","3.10.3+dfsg-2","3.10.3~rc1+dfsg-1~exp1","3.11.0+dfsg-1~exp1","3.11.0~beta1+dfsg-1~exp1","3.11.0~beta1+dfsg-1~exp2","3.11.0~rc1+dfsg-1~exp1","3.11.0~rc1+dfsg-1~exp2","3.11.0~rc2+dfsg-1~exp1","3.11.1+dfsg-1~exp1","3.11.1~rc1+dfsg-1~exp1","3.11.1~rc2+dfsg-1~exp1","3.11.2+dfsg-1~exp1","3.11.2~rc1+dfsg-1~exp1","3.11.2~rc2+dfsg-1~exp1","3.11.3+dfsg-1","3.11.3+dfsg-1~exp1","3.11.3+dfsg-1~exp2","3.11.4+dfsg-1","3.11.4~rc1+dfsg-1~exp1","3.12.0+dfsg-1","3.12.0+dfsg-1~exp1","3.12.0~beta1+dfsg-1~exp1","3.12.0~rc1+dfsg-1~exp1","3.12.1+dfsg-1","3.12.1~rc1+dfsg-1~exp1","3.12.2+dfsg-1","3.12.2~rc1+dfsg-1~exp1","3.12.3+dfsg-1","3.12.3~rc1+dfsg-1~exp1","3.12.3~rc2+dfsg-1~exp1","3.13.0+dfsg-1","3.13.0+dfsg-1~exp1","3.13.0~beta1+dfsg-1~exp1","3.13.0~beta2+dfsg-1~exp1","3.13.0~rc1+dfsg-1~exp1","3.13.0~rc2+dfsg-1~exp1","3.13.1+dfsg-1","3.13.1~rc1+dfsg-1~exp1","3.13.2+dfsg-1","3.13.2~rc1+dfsg-1~exp1","3.13.3+dfsg-1","3.13.3+dfsg-2","3.13.3~rc1+dfsg-1~exp1","3.6.2+dfsg-1","3.6.3+dfsg-1~exp1","3.6.3~rc1+dfsg-1~exp1","3.6.4+dfsg-1","3.6.4+dfsg-1~exp1","3.6.4~rc1+dfsg-1~exp1","3.7.0+dfsg-1","3.7.0+dfsg-1~exp1","3.7.0~rc1+dfsg-1~exp1","3.7.1+dfsg-1","3.7.1~rc1+dfsg-1~exp1","3.7.2+dfsg-1","3.7.2~rc1+dfsg-1~exp1","3.7.3+dfsg-1","3.7.3~rc1+dfsg-1~exp1","3.8.0+dfsg-1","3.8.0+dfsg-1~exp1","3.8.0~beta1+dfsg-1~exp1","3.8.0~rc1+dfsg-1~exp1","3.8.0~rc1+dfsg-1~exp2","3.8.0~rc2+dfsg-1~exp1","3.8.1+dfsg-1","3.8.1~rc1+dfsg-1~exp1","3.8.1~rc2+dfsg-1~exp1","3.8.1~rc3+dfsg-1~exp1","3.8.2+dfsg-1","3.8.2~rc1+dfsg-1~exp1","3.8.3+dfsg-1","3.8.3+dfsg-1.1~exp1","3.8.3+dfsg-2~exp1","3.8.3~rc1+dfsg-1~exp1","3.8.3~rc2+dfsg-1~exp1","3.8.3~rc3+dfsg-1~exp1","3.8.4+dfsg-1","3.8.4+dfsg-2","3.8.4+dfsg-2~exp1","3.8.4+dfsg-3","3.8.4~rc1+dfsg-1~exp1","3.8.5+dfsg-1","3.8.5~rc1+dfsg-1~exp1","3.9.0+dfsg-1","3.9.0+dfsg-1~exp1","3.9.0~beta1+dfsg-1~exp1","3.9.0~beta2+dfsg-1~exp1","3.9.0~rc1+dfsg-1~exp1","3.9.0~rc2+dfsg-1~exp1","3.9.1+dfsg-1","3.9.1~rc1+dfsg-1~exp1","3.9.1~rc2+dfsg-1~exp1","3.9.2+dfsg-1","3.9.2~rc1+dfsg-1~exp1","3.9.2~rc2+dfsg-1~exp1","3.9.3+dfsg-1","3.9.3~rc1+dfsg-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.3+dfsg-1","3.10.3+dfsg-2","3.11.0+dfsg-1~exp1","3.11.0~beta1+dfsg-1~exp1","3.11.0~beta1+dfsg-1~exp2","3.11.0~rc1+dfsg-1~exp1","3.11.0~rc1+dfsg-1~exp2","3.11.0~rc2+dfsg-1~exp1","3.11.1+dfsg-1~exp1","3.11.1~rc1+dfsg-1~exp1","3.11.1~rc2+dfsg-1~exp1","3.11.2+dfsg-1~exp1","3.11.2~rc1+dfsg-1~exp1","3.11.2~rc2+dfsg-1~exp1","3.11.3+dfsg-1","3.11.3+dfsg-1~exp1","3.11.3+dfsg-1~exp2","3.11.4+dfsg-1","3.11.4~rc1+dfsg-1~exp1","3.12.0+dfsg-1","3.12.0+dfsg-1~exp1","3.12.0~beta1+dfsg-1~exp1","3.12.0~rc1+dfsg-1~exp1","3.12.1+dfsg-1","3.12.1~rc1+dfsg-1~exp1","3.12.2+dfsg-1","3.12.2~rc1+dfsg-1~exp1","3.12.3+dfsg-1","3.12.3~rc1+dfsg-1~exp1","3.12.3~rc2+dfsg-1~exp1","3.13.0+dfsg-1","3.13.0+dfsg-1~exp1","3.13.0~beta1+dfsg-1~exp1","3.13.0~beta2+dfsg-1~exp1","3.13.0~rc1+dfsg-1~exp1","3.13.0~rc2+dfsg-1~exp1","3.13.1+dfsg-1","3.13.1~rc1+dfsg-1~exp1","3.13.2+dfsg-1","3.13.2~rc1+dfsg-1~exp1","3.13.3+dfsg-1","3.13.3+dfsg-2","3.13.3~rc1+dfsg-1~exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1+dfsg-1"}]}],"versions":["3.10.3+dfsg-1","3.10.3+dfsg-2","3.11.0+dfsg-1~exp1","3.11.0~beta1+dfsg-1~exp1","3.11.0~beta1+dfsg-1~exp2","3.11.0~rc1+dfsg-1~exp1","3.11.0~rc1+dfsg-1~exp2","3.11.0~rc2+dfsg-1~exp1","3.11.1+dfsg-1~exp1","3.11.1~rc1+dfsg-1~exp1","3.11.1~rc2+dfsg-1~exp1","3.11.2+dfsg-1~exp1","3.11.2~rc1+dfsg-1~exp1","3.11.2~rc2+dfsg-1~exp1","3.11.3+dfsg-1","3.11.3+dfsg-1~exp1","3.11.3+dfsg-1~exp2","3.11.4+dfsg-1","3.11.4~rc1+dfsg-1~exp1","3.12.0+dfsg-1","3.12.0+dfsg-1~exp1","3.12.0~beta1+dfsg-1~exp1","3.12.0~rc1+dfsg-1~exp1","3.12.1+dfsg-1","3.12.1~rc1+dfsg-1~exp1","3.12.2+dfsg-1","3.12.2~rc1+dfsg-1~exp1","3.12.3+dfsg-1","3.12.3~rc1+dfsg-1~exp1","3.12.3~rc2+dfsg-1~exp1","3.13.0+dfsg-1","3.13.0+dfsg-1~exp1","3.13.0~beta1+dfsg-1~exp1","3.13.0~beta2+dfsg-1~exp1","3.13.0~rc1+dfsg-1~exp1","3.13.0~rc2+dfsg-1~exp1","3.13.1~rc1+dfsg-1~exp1"]},{"source":"osv","ecosystem":"PyPI","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.13.1"}]}],"versions":["3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.12.0.post1","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.2.0","3.2.1","3.2.2","3.2.2.1","3.2.3","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.5.0","3.5.0.3","3.5.1","3.5.2","3.5.3","3.6.0","3.6.0.1","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.1.1","3.7.2","3.7.3","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.9.0","3.9.1","3.9.2","3.9.3"]},{"source":"osv","ecosystem":"Julia","package":"GDAL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0+0"},{"fixed":"305.1300.100+0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.13.1"}]}],"versions":["3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.12.0.post1","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.2.0","3.2.1","3.2.2","3.2.2.1","3.2.3","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.5.0","3.5.0.3","3.5.1","3.5.2","3.5.3","3.6.0","3.6.0.1","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.1.1","3.7.2","3.7.3","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.9.0","3.9.1","3.9.2","3.9.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.2.2+dfsg-3ubuntu2","3.4.0+dfsg-1","3.4.1+dfsg-1","3.4.1+dfsg-1build1","3.4.1+dfsg-1build3","3.4.1+dfsg-1build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4+dfsg-3ubuntu3+esm1"}]}],"versions":["3.7.1+dfsg-1build1","3.8.0+dfsg-1","3.8.1+dfsg-1build1","3.8.2+dfsg-1","3.8.3+dfsg-1","3.8.4+dfsg-1","3.8.4+dfsg-3ubuntu2","3.8.4+dfsg-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2+dfsg-1build3","3.10.3+dfsg-1","3.10.3+dfsg-1build1","3.10.3+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.10.3+dfsg-1build2","3.10.3+dfsg-1build3","3.11.4+dfsg-1","3.12.0+dfsg-1","3.12.1+dfsg-1","3.12.2+dfsg-1","3.12.2+dfsg-1build1","3.12.2+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-5ubuntu1+esm3"}]}],"versions":["1.9.0-3.1ubuntu4","1.9.0-3.1ubuntu6","1.10.1+dfsg-2","1.10.1+dfsg-2build1","1.10.1+dfsg-3","1.10.1+dfsg-3build1","1.10.1+dfsg-3build2","1.10.1+dfsg-3ubuntu1","1.10.1+dfsg-3ubuntu2","1.10.1+dfsg-5ubuntu1","1.10.1+dfsg-5ubuntu1+esm1","1.10.1+dfsg-5ubuntu1+esm2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3+dfsg-3ubuntu0.1~esm2"}]}],"versions":["1.11.2+dfsg-3ubuntu3","1.11.2+dfsg-3ubuntu4","1.11.3+dfsg-2build1","1.11.3+dfsg-2build2","1.11.3+dfsg-2build3","1.11.3+dfsg-3","1.11.3+dfsg-3build1","1.11.3+dfsg-3build2","1.11.3+dfsg-3ubuntu0.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3+dfsg-2ubuntu0.1~esm1"}]}],"versions":["2.2.1+dfsg-2build3","2.2.1+dfsg-2build5","2.2.2+dfsg-2build1","2.2.3+dfsg-1","2.2.3+dfsg-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4+dfsg-1ubuntu0.1~esm1"}]}],"versions":["2.4.2+dfsg-1build2","2.4.2+dfsg-1build4","2.4.2+dfsg-2","2.4.3+dfsg-1","3.0.4+dfsg-1","3.0.4+dfsg-1build1","3.0.4+dfsg-1build2","3.0.4+dfsg-1build3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.2.2+dfsg-3ubuntu2","3.4.0+dfsg-1","3.4.1+dfsg-1","3.4.1+dfsg-1build1","3.4.1+dfsg-1build3","3.4.1+dfsg-1build4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4+dfsg-3ubuntu3+esm1"}]}],"versions":["3.7.1+dfsg-1build1","3.8.0+dfsg-1","3.8.1+dfsg-1build1","3.8.2+dfsg-1","3.8.3+dfsg-1","3.8.4+dfsg-1","3.8.4+dfsg-3ubuntu2","3.8.4+dfsg-3ubuntu3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.10.3+dfsg-1build2","3.10.3+dfsg-1build3","3.11.4+dfsg-1","3.12.0+dfsg-1","3.12.1+dfsg-1","3.12.2+dfsg-1","3.12.2+dfsg-1build1","3.12.2+dfsg-1build2"],"bundled":7}],"products":[{"vendor":"gdal","product":"gdal"},{"vendor":"osgeo","product":"gdal"}],"references":[{"url":"https://github.com/OSGeo/gdal/issues/14594","tags":["exploit","Issue Tracking","Mitigation","Vendor Advisory","advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49014","tags":["web","advisory"]},{"url":"https://github.com/OSGeo/gdal/pull/14598","tags":["web"]},{"url":"https://github.com/OSGeo/gdal/commit/f5ebabc1042f3c59b24e7c8ad45dda242d127f09","tags":["web"]},{"url":"https://github.com/OSGeo/gdal/blob/v3.13.1/NEWS.md","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gdal/PYSEC-2026-193.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wphc-7cm7-8mf7","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49014.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49014","tags":["advisory"]},{"url":"https://github.com/OSGeo/gdal","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-49014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49014","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8812-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8213","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-49014","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T01:39:18.976Z","modified":"2026-05-27T13:52:05.905Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-32039","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T01:39:18Z","modified":"2026-05-27T13:52:05Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:21:04.78276Z"}],"ghsa":[{"id":"GHSA-wphc-7cm7-8mf7","title":"GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T03:30:31Z","modified":"2026-07-01T18:07:08Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"nvd":[{"id":"CVE-2026-49014","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T02:16:34.18Z","modified":"2026-07-24T12:10:00.21Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:20.511562Z"}],"osv":[{"id":"CVE-2026-49014","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T01:39:18.976Z","modified":"2026-10-28T02:31:06.270014343Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-49014","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T02:16:34.18Z","modified":"2026-10-01T03:03:07.956420993Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-wphc-7cm7-8mf7","title":"GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T03:30:31Z","modified":"2026-07-01T18:26:13.624993475Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"JLSEC-2026-766","title":"GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in `frmts/netcdf/netcdfsg.cpp`.","status":"published","published":"2026-07-15T21:25:44.755Z","modified":"2026-07-25T18:24:52.936828167Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"PYSEC-2026-193","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T02:16:34.18Z","modified":"2026-07-13T16:45:11.431168083Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-49014","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T02:16:00Z","modified":"2026-09-24T18:30:06.056563624Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-88380","title":"CVE-2026-49014 affecting package gdal 3.6.3-2","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-05-27T02:16:34Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"BIT-gdal-2026-49014","description":"In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.","status":"published","published":"2026-06-05T08:44:46.134Z","modified":"2026-09-10T16:01:31.589248121Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"USN-8812-1","title":"gdal vulnerabilities","description":"It was discovered that GDAL incorrectly handled certain netCDF files. An\nattacker could possibly use this issue to execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-49014)\n\nIt was discovered that GDAL incorrectly handled certain HDF-EOS files. An\nattacker could possibly use this issue to cause a crash or execute arbitrary\ncode. (CVE-2026-8086, CVE-2026-8087, CVE-2026-8212, CVE-2026-8213)\n\nIt was discovered that GDAL incorrectly handled certain HDF-EOS file\nmetadata. An attacker could possibly use this issue to cause GDAL to crash,\nresulting in a denial of service. (CVE-2026-8084, CVE-2026-8088)","status":"published","published":"2026-09-24T11:38:56Z","modified":"2026-09-25T00:43:11.990084383Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}