GDAL up to 3.13.0 netCDF Driver netcdfsg.cpp geometry stack-based overflow

Summaryinfo

A vulnerability has been found in GDAL up to 3.13.0 and classified as critical. This affects an unknown part of the file frmts/netcdf/netcdfsg.cpp of the component netCDF Driver. This manipulation of the argument geometry causes stack-based overflow. This vulnerability is handled as CVE-2026-49014. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in GDAL up to 3.13.0. Affected by this vulnerability is an unknown part of the file frmts/netcdf/netcdfsg.cpp of the component netCDF Driver. The manipulation of the argument geometry with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-49014 since 05/27/2026. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/07/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202605-6100) and EUVD (EUVD-2026-32039). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• GDAL

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion