CVE-2026-49014: GDAL NetCDF Buffer Overflow Vulnerability

CVE-2026-49014 Overview

CVE-2026-49014 is a stack-based buffer overflow [CWE-121] in the Geospatial Data Abstraction Library (GDAL) netCDF driver. The flaw resides in the scanForGeometryContainers function within frmts/netcdf/netcdfsg.cpp. Affected versions span GDAL 3.1.0 through 3.13.0. The driver reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. An attacker crafts a malicious NetCDF file containing an oversized geometry attribute. When GDAL parses the file, the overflow can lead to arbitrary code execution on the host processing the data.

Critical Impact
Attackers can achieve arbitrary code execution on systems that parse untrusted NetCDF files through GDAL.

Affected Products

GDAL 3.1.0 through 3.13.0
Applications embedding the GDAL netCDF driver
Geospatial processing pipelines that ingest user-supplied NetCDF files

Discovery Timeline

2026-05-27 - CVE-2026-49014 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-49014

Vulnerability Analysis

The vulnerability resides in the scanForGeometryContainers routine of the GDAL netCDF driver. This function processes geometry container attributes embedded inside NetCDF files. The implementation copies a geometry attribute value into a fixed-size buffer allocated on the stack. The code does not validate the attribute length before performing the copy. When the attribute exceeds the buffer size, adjacent stack memory is overwritten.

Stack-based overflows in C/C++ parsers commonly enable corruption of saved return addresses, stack canaries, or function pointers stored near the buffer. Successful exploitation transfers control flow to attacker-supplied data. Because GDAL is widely embedded in server-side geospatial workflows, the overflow can execute code in the security context of the process invoking the library.

Root Cause

The root cause is missing input validation on a length-bearing field within the NetCDF geometry attribute. The driver trusts the attribute length supplied by the file and writes the contents into a fixed stack allocation in frmts/netcdf/netcdfsg.cpp. The absence of a bounds check before the copy classifies the issue as [CWE-121] stack-based buffer overflow.

Attack Vector

The attacker delivers a crafted NetCDF file to a system that processes it with GDAL. Although the CVSS attack vector is local, any server-side workflow that ingests user-supplied geospatial files extends the practical reach of this flaw. Web mapping services, conversion pipelines, and batch processors that accept NetCDF uploads are typical exposure points. No authentication is required to trigger parsing in such pipelines, but successful code execution requires reliable bypass of stack protections present on the target.

The vulnerability is described in prose only because no verified public exploit code is available. See the GitHub Issue Report for upstream technical discussion.

Detection Methods for CVE-2026-49014

Indicators of Compromise

NetCDF files containing geometry container attributes with abnormally large length values
Crashes or segmentation faults in processes loading the GDAL netCDF driver
Unexpected child processes spawned by services that invoke gdal_translate, ogr2ogr, or applications linking libgdal
Outbound network connections initiated by geospatial processing workers after NetCDF ingestion

Detection Strategies

Inspect NetCDF inputs for oversized geometry attributes before passing them to GDAL
Enable core dump collection on GDAL workers and alert on crashes inside scanForGeometryContainers
Compare deployed GDAL versions against the affected range 3.1.0 through 3.13.0 using software inventory data
Hunt for anomalous process lineage where GDAL utilities spawn shells or interpreters

Monitoring Recommendations

Log all invocations of GDAL command-line tools with arguments and file hashes
Monitor file upload endpoints that accept .nc files for size and structure anomalies
Track CPU and memory anomalies in geospatial conversion services that may indicate exploitation attempts

How to Mitigate CVE-2026-49014

Immediate Actions Required

Identify all systems running GDAL versions 3.1.0 through 3.13.0 and prioritize them for patching
Restrict NetCDF file ingestion to trusted sources until patched builds are deployed
Run GDAL processing workloads under least-privilege service accounts with no interactive shell access
Enable stack protections including ASLR, stack canaries, and non-executable stacks on all hosts running GDAL

Patch Information

The upstream fix is tracked in the GitHub Issue Report for the OSGeo GDAL project. Upgrade to a GDAL release that includes bounds validation in scanForGeometryContainers within frmts/netcdf/netcdfsg.cpp. Rebuild and redistribute any applications that statically link the affected GDAL versions.

Workarounds

Disable the netCDF driver in GDAL builds where it is not required by removing netCDF support at compile time
Sandbox GDAL parsing in containers or seccomp-restricted processes with no network egress
Pre-validate NetCDF inputs with a separate tool that rejects files containing oversized geometry attributes
Process untrusted NetCDF files in isolated worker nodes that are reset after each job

bash

# Configuration example: build GDAL without netCDF support
./configure --without-netcdf
make && sudo make install

# Verify the netCDF driver is not registered
gdalinfo --formats | grep -i netcdf