CVE-2026-49014: GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow
(updated )
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
References
- github.com/OSGeo/gdal/blob/v3.13.1/NEWS.md
- github.com/OSGeo/gdal/commit/f5ebabc1042f3c59b24e7c8ad45dda242d127f09
- github.com/OSGeo/gdal/issues/14594
- github.com/OSGeo/gdal/pull/14598
- github.com/advisories/GHSA-wphc-7cm7-8mf7
- github.com/pypa/advisory-database/tree/main/vulns/gdal/PYSEC-2026-193.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-49014
Code Behaviors & Features
Detect and mitigate CVE-2026-49014 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →