CVE-2026-49014

Name
CVE-2026-49014
Description
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://github.com/OSGeo/gdal/issues/14594

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:* gdal >= 3.1.0 <= 3.13.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
gdal edge-community 3.13.0-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.13.0-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.4-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.3-r4 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.3-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.3-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.3-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.3-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.2-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.2-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.2-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.1-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.1-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.1-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.1-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.12.0-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.5-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.5-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.5-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r6 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r5 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r4 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.4-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.3-r4 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.3-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.3-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.3-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.3-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.1-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.1-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.0-r4 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.0-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.0-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.11.0-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.3-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.3-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.2-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.2-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.2-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.1-r3 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.1-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.1-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.1-r0 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal edge-community 3.10.0-r7 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal 3.24-community 3.13.0-r1 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable
gdal 3.23-community 3.11.5-r2 Holger Jaekel <holger.jaekel@gmx.de> possibly vulnerable