PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49014 GDAL CVE debrief

A stack-based buffer overflow vulnerability exists in the GDAL netCDF driver affecting versions 3.1.0 through 3.13.0. The flaw resides in the `scanForGeometryContainers` function within `frmts/netcdf/netcdfsg.cpp`, where a geometry attribute is read into a fixed-size stack buffer without length validation. An attacker can achieve arbitrary code execution by embedding an oversized geometry attribute in a crafted NetCDF file. The vulnerability requires local access with high attack complexity per the CVSS vector, but successful exploitation yields high impact across confidentiality, integrity, and availability. The affected component is the netCDF format driver, commonly used in geospatial data processing workflows. No known exploitation in ransomware campaigns has been documented.

Vendor
GDAL
Product
Unknown
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-07-23
Advisory published
2026-05-27
Advisory updated
2026-07-23

Who should care

Organizations running GDAL-based geospatial data processing services, particularly those accepting NetCDF uploads from untrusted sources. Cloud providers offering geospatial data transformation pipelines. Scientific computing environments using GDAL for climate and environmental data analysis. Security teams responsible for supply chain risk management in open-source geospatial software stacks.

Technical summary

The vulnerability is a classic stack-based buffer overflow (CWE-121) in GDAL's netCDF vector driver. The `scanForGeometryContainers` function in `frmts/netcdf/netcdfsg.cpp` copies geometry attribute data into a fixed-size stack buffer without bounds checking. When processing a malicious NetCDF file containing an oversized geometry attribute, the buffer overflow can overwrite the return address, enabling arbitrary code execution. The CVSS 3.1 score of 7.4 (HIGH) reflects significant impact potential despite the local attack vector and high complexity requirements. The vulnerability affects GDAL versions 3.1.0 through 3.13.0, spanning approximately six years of releases.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade GDAL to a version beyond 3.13.0 when a patched release becomes available
  • Restrict processing of untrusted NetCDF files in production GDAL deployments
  • Implement input validation and sandboxing for geospatial data processing pipelines
  • Monitor GDAL security advisories and the referenced GitHub issue for patch availability
  • Apply principle of least privilege to GDAL service accounts to limit exploitation impact

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. CVSS 3.1 vector confirms local attack vector with high complexity. Weakness classified as CWE-121 (Stack-based Buffer Overflow). GitHub issue reference provided by MITRE as primary source reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49014 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49014

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49014 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49014

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.