CVE-2026-49014 GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow

What is CVE-2026-49014?

CVE-2026-49014 is a high-severity memory corruption vulnerability in GDAL, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.

Weakness: CWE-121

Which versions are affected by CVE-2026-49014?

4 open source packages ship an affected version, including gdal. It affects 1 product.

Products include Osgeo Gdal.

How do I fix CVE-2026-49014?

Upgrade gdal to 3.13.1 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-49014 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49014 exists.

Other vulnerabilities in GDAL

• CVE-2019-25050 Memory corruption in n/a High 7.8
• CVE-2025-29480 Memory corruption in n/a Medium 5.5
• CVE-2026-8212 OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow Medium 4.8
• CVE-2026-8213 OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow Medium 4.8
• CVE-2026-8084 OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-88380, BIT-gdal-2026-49014, DEBIAN-CVE-2026-49014, ECHO-d542-982c-16cf, GHSA-wphc-7cm7-8mf7, JLSEC-2026-766 and 2 more.