CVE-2026-49014
published 2026-05-27CVE-2026-49014: In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry…
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.10%
1.2th percentile
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gdal | gdal | 3.1.0 – 3.13.0 | — |
| osgeo | gdal | 3.1.0 – 3.13.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GDAL up to 3.13.0 netCDF Driver netcdfsg.cpp geometry stack-based overflow (Issue 14594 / EUVD-2026-32039)
vuldb·2026-05-28·CVSS 7.4
CVE-2026-49014 [HIGH] GDAL up to 3.13.0 netCDF Driver netcdfsg.cpp geometry stack-based overflow (Issue 14594 / EUVD-2026-32039)
A vulnerability, which was classified as critical, was found in GDAL up to 3.13.0. Affected by this issue is some unknown functionality of the file frmts/netcdf/netcdfsg.cpp of the component netCDF Driver. The manipulation of the argument geometry results in stack-based buffer overflow.
This vulnerability is known as CVE-2026-49014. Attacking locally is a requirement. No exploit is available.
GHSA
GHSA-wphc-7cm7-8mf7: In GDAL 3
ghsa_unreviewed·2026-05-27
CVE-2026-49014 [HIGH] CWE-121 GHSA-wphc-7cm7-8mf7: In GDAL 3
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-27
Published