CVE-2026-8212: OSGeo GDAL Buffer Overflow Vulnerability

CVE-2026-8212 Overview

CVE-2026-8212 is a heap-based buffer overflow [CWE-119] affecting OSGeo GDAL up to version 3.13.0dev-4. The flaw resides in the SWSDfldsrch function within frmts/hdf4/hdf-eos/SWapi.c, which handles HDF-EOS swath field lookups. When the function processes a FieldList metadata value, it performs an unchecked memmove to strip leading and trailing quote characters, leading to memory corruption when malformed input is supplied. Exploitation requires local access and low privileges. A public proof-of-concept exists, and the issue is fixed in GDAL 3.13.0RC1 via commit 3e04c0385630e4d42517046d9a4967dfccfeb7fd.

Critical Impact

Local attackers supplying crafted HDF4-EOS files can trigger a heap-based buffer overflow in GDAL, enabling memory corruption and potential out-of-bounds reads in geospatial processing workflows.

Affected Products

• OSGeo GDAL versions up to and including 3.13.0dev-4
• GDAL HDF4-EOS driver (frmts/hdf4/hdf-eos/SWapi.c)
• Applications and libraries embedding vulnerable GDAL builds for HDF4-EOS parsing

Discovery Timeline

• 2026-05-09 - CVE-2026-8212 published to NVD
• 2026-05-13 - Last updated in NVD database
• Fix commit - 3e04c0385630e4d42517046d9a4967dfccfeb7fd merged, released in GDAL 3.13.0RC1

Technical Details for CVE-2026-8212

Vulnerability Analysis

The vulnerability stems from improper bounds validation in SWSDfldsrch, a helper used by GDAL's HDF4-EOS swath API. The function calls EHgetmetavalue(metaptrs, "FieldList", name) to retrieve a metadata value, then immediately strips the first and last characters under the assumption that the value is quoted. No check confirms that the return status was successful or that the buffer contents are at least two characters long and bounded by " quote characters.

When EHgetmetavalue fails or returns a string shorter than two characters, strlen(name) - 2 underflows into a large size_t value. The subsequent memmove(name, name + 1, strlen(name) - 2) copies far beyond the allocated heap buffer, producing a heap-based buffer overflow. The same defective pattern existed in GDapi.c, where the patch applied identical hardening.

Root Cause

The root cause is missing validation of the return value from EHgetmetavalue combined with an unchecked length assumption before quote stripping. The original code treats untrusted metadata content as if it were always a valid quoted string, allowing length underflow when the field is empty, malformed, or absent.

Attack Vector

Exploitation requires local access. An attacker provides a crafted HDF4-EOS file that a victim user or service parses with a vulnerable GDAL build. Processing the malformed FieldList triggers the overflow inside the swath field search routine. Public PoC code targeting the out-of-bounds read variant is available in a third-party repository.

// Patched code in frmts/hdf4/hdf-eos/SWapi.c
/* Get field list and strip off leading and trailing quotes */
if (EHgetmetavalue(metaptrs, "FieldList", name) == 0)
{
    const size_t len = strlen(name);
    if (len >= 2 && name[0] == '"' && name[len-1] == '"')
    {
        memmove(name, name + 1, strlen(name) - 2);
        name[strlen(name) - 2] = 0;
    }
}
else
{
    name[0] = '\0';
}

/* Search for desired field within merged field list */
snprintf(utlstr, UTLSTR_MAX_SIZE, "%s%s%s", "\"", fieldname, "\"");

Source: GitHub Commit 3e04c03. The patch adds a return status check, verifies the buffer length and quote delimiters, and zero-initializes name on failure.

Detection Methods for CVE-2026-8212

Indicators of Compromise

• GDAL or applications linking GDAL crashing while parsing HDF4-EOS swath files, with stack traces referencing SWSDfldsrch or EHgetmetavalue
• AddressSanitizer or Valgrind reports flagging heap-buffer-overflow in frmts/hdf4/hdf-eos/SWapi.c
• Unexpected presence of crafted .hdf files in geospatial processing pipelines from untrusted sources

Detection Strategies

• Inventory all hosts running GDAL builds at or below 3.13.0dev-4, including container images and Python gdal bindings
• Enable compiler hardening (-fstack-protector-strong, -D_FORTIFY_SOURCE=2) and run GDAL-based tools under sanitizers in test environments to surface overflow conditions
• Monitor process telemetry for repeated crashes or abnormal exits of GDAL-linked binaries such as gdalinfo, gdal_translate, or QGIS workers

Monitoring Recommendations

• Log file ingestion events that involve HDF4-EOS content and correlate with downstream process crashes
• Alert on segmentation faults or core dumps generated by GDAL utilities in production batch jobs
• Track package versions across Linux distributions and Conda environments to confirm patched GDAL builds are deployed

How to Mitigate CVE-2026-8212

Immediate Actions Required

• Upgrade GDAL to 3.13.0RC1 or later, which includes commit 3e04c0385630e4d42517046d9a4967dfccfeb7fd
• Restrict ingestion of HDF4-EOS files to trusted sources until patched binaries are deployed
• Run GDAL-based services under least-privilege accounts to limit the impact of local exploitation

Patch Information

The fix is published in the GitHub Release v3.13.0RC1. The corresponding source change is in GitHub Commit 3e04c03, and additional context is available in GitHub Issue #14398. The patch validates the EHgetmetavalue return code and confirms that the metadata value is a properly quoted string before performing the in-place memmove.

Workarounds

• Disable the HDF4 driver at runtime by unsetting it via GDAL_SKIP="HDF4 HDF4Image" where HDF4-EOS support is not required
• Sandbox GDAL workloads using seccomp, AppArmor, or container isolation to contain potential memory corruption
• Validate and quarantine incoming HDF4-EOS files via a separate parsing stage before exposing them to production GDAL services

# Configuration example: disable HDF4 drivers in environments that do not require them
export GDAL_SKIP="HDF4 HDF4Image"

# Verify installed GDAL version is patched (>= 3.13.0RC1)
gdalinfo --version

# Upgrade via pip (example)
pip install --upgrade "gdal>=3.13.0rc1"