{"id":"CVE-2026-49014","aliases":["GHSA-wphc-7cm7-8mf7","BIT-gdal-2026-49014","PYSEC-2026-193"],"title":"GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow","summary":"GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"gdal","product":"gdal","ecosystem":"pip","affected":["gdal >= 3.1.0, < 3.13.1"],"patched":["gdal 3.13.1"],"published":"2026-05-27","updated":"2026-07-01","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wphc-7cm7-8mf7","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49014"},{"url":"https://github.com/OSGeo/gdal/issues/14594"},{"url":"https://github.com/OSGeo/gdal/pull/14598"},{"url":"https://github.com/OSGeo/gdal/commit/f5ebabc1042f3c59b24e7c8ad45dda242d127f09"},{"url":"https://github.com/OSGeo/gdal"},{"url":"https://github.com/OSGeo/gdal/blob/v3.13.1/NEWS.md"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gdal/PYSEC-2026-193.yaml"}],"tags":["osv","pip"],"epss":0.00102,"epssPercentile":0.01064,"ingestedAt":"2026-07-08T18:25:53.862Z","slug":"CVE-2026-49014","body":"## Overview\n\nIn GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.\n\n## Affected packages\n\n- `gdal >= 3.1.0, < 3.13.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gdal 3.13.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}