Name: CVE-2026-8086: Heap-based Buffer Overflow
Creator: Rapid7
Published: 2026-05-07T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-8086, CWE-119, CWE-122, CVSS 7.8, EPSS 0.00021

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 3.12.4RC1 is capable of addressing this issue. The name of the patch is 9491e794f1757f08063ea2f7a274ad2994afa636. It is advisable to upgrade the affected component.

CVSS Details

CVSS 4.0 Base Score: 1.9 (LOW)
CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS 3.0 Base Score: 5.3

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Ubuntu	—	Upgrade libgdal26 (Ubuntu Pro)Upgrade libgdal38 (Ubuntu Pro)Upgrade libgdal30 (Ubuntu Pro)Upgrade gdal-bin (Ubuntu Pro)Upgrade libgdal1i (Ubuntu Pro)Upgrade libgdal34t64 (Ubuntu Pro)Upgrade libgdal20 (Ubuntu Pro)Upgrade libgdal1h (Ubuntu Pro)	Sep 24, 2026	May 7, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence