CVE-2026-49014 json
GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow
published 2026-05-27 5 mo ago modified 2026-09-10 59 d ago also BIT-gdal-2026-49014 , EUVD-2026-32039 , GHSA-wphc-7cm7-8mf7 , JLSEC-2026-766 , PYSEC-2026-193
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 0%
- public exploits
- 0
- none known
Summary
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
Patch / fix
- pypi gdal 3.13.1
- bitnami gdal 3.13.1
- julia GDAL_jll 305.1300.100+0
- gdal Debian 14 3.13.1+dfsg-1
debian advisories DEBIAN-CVE-2026-49014
- gdal Ubuntu Pro 22.04 LTS 3.4.1+dfsg-1ubuntu0.1~esm1
- gdal Ubuntu Pro 24.04 LTS 3.8.4+dfsg-3ubuntu3+esm1
- gdal Ubuntu Pro 26.04 LTS 3.12.2+dfsg-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2026-49014
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/OSGeo/gdal@f5ebabc commit
- github.com/OSGeo/gdal#14598 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.10% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/OSGeo/gdal/issues/14594 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.4 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gdal | >=3.1.0, <3.13.1 |
3.13.1 |
| bitnami | gdal | >=3.1.0, <3.13.1 |
3.13.1 |
| julia | GDAL_jll | >=3.2.0+0, <305.1300.100+0 |
305.1300.100+0 |
Affected products
- GDAL GDAL
Classification
- Weakness
-
- CWE-121 Stack-based Buffer Overflow
References
-
github.com
/OSGeo/gdal/pull/14598
web
-
github.com
/OSGeo/gdal/commit/f5ebabc1042f3c59b24e7c8ad45dda242d127f09
web
-
github.com
/OSGeo/gdal/issues/14594
exploit, web, issue-tracking, mitigation, vendor-advisory, advisory, report
-
nvd.nist.gov
/vuln/detail/CVE-2026-49014
advisory, web
-
github.com
/OSGeo/gdal
package
-
github.com
/OSGeo/gdal/blob/v3.13.1/NEWS.md
web
-
github.com
/pypa/advisory-database/tree/main/vulns/gdal/PYSEC-2026-193.yaml
web
-
github.com
/advisories/GHSA-wphc-7cm7-8mf7
web, advisory
Sources
- CVE List CVE-2026-49014
- GitHub Advisory GHSA-wphc-7cm7-8mf7
- NVD CVE-2026-49014
- OSV BIT-gdal-2026-49014
- OSV JLSEC-2026-766
- OSV PYSEC-2026-193
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.