cve-2026-4738

{
  "cve": "CVE-2026-4738",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[0,3.11.0)"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "gdal",
          "source": "cna",
          "vendor": "OSGeo"
        },
        "product": "gdal",
        "vendor": "osgeo"
      }
    ],
    "analysis": {
      "en": {
        "generated_at": "2026-03-24T04:21:08.503723+00:00",
        "value": {
          "mitigation_remediation": [
            "Upgrade GDAL to version 3.11.0 or newer.",
            "If an immediate upgrade is not possible, limit GDAL processing to trusted inputs and monitor for unusual activity.",
            "Verify the GDAL version on all systems and apply any available vendor patches."
          ],
          "summary": {
            "action": "Immediate Patch",
            "impact": "Remote Code Execution"
          },
          "threat_synthesis": {
            "affected_systems": "OSGeo GDAL releases prior to version 3.11.0 are affected by this flaw. The vulnerability impacts the zlib decompression component within GDAL, especially the inftree9.c module. Administrators should check all installations running GDAL below 3.11.0 to determine exposure.",
            "description_and_impact": "The vulnerability arises from an improper restriction of operations within the bounds of a memory buffer in OSGeo GDAL, specifically within the frmts/zlib/contrib/infback9 modules. The flaw originates in the inftree9.c file, where a pointer offset optimization leads to undefined behavior. An attacker can trigger this error to corrupt heap memory, potentially escalating to remote code execution. This weakness aligns with CWE‑119, which involves buffer overflow or underflow attacks.",
            "risk_and_exploitability": "The CVSS score of 9.4 indicates critical severity, though direct exploit evidence is not documented in the current advisory. The vulnerability is not yet listed in CISA’s KEV catalog, and no EPSS value is available. Likely exploitation would involve feeding a crafted zlib stream to GDAL’s decompression routine, causing the undefined behavior and enabling remote code execution. Because the flaw resides in a widely used geospatial library, the potential impact spans any system that processes untrusted geospatial data."
          }
        }
      }
    },
    "created": "2026-03-24T10:29:14.616530+00:00",
    "updated": "2026-03-25T20:40:19.849829+00:00",
    "vendors": [
      "osgeo",
      "osgeo$PRODUCT$gdal"
    ]
  },
  "epss": {
    "score": 0.00428
  },
  "mitre": {
    "cpes": [],
    "created": "2026-03-24T03:18:10.245000+00:00",
    "description": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {
        "score": 9.4,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:P/AU:Y/R:U/V:C/RE:L/U:Amber"
      }
    },
    "mitre_repo_path": "cves/2026/4xxx/CVE-2026-4738.json",
    "references": [
      "https://github.com/OSGeo/gdal/pull/12244"
    ],
    "title": "GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution",
    "updated": "2026-03-24T14:35:23.904000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-119"
    ]
  },
  "nvd": {
    "cpes": [],
    "created": "2026-03-24T04:17:29+00:00",
    "description": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {
        "score": 9.4,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber"
      }
    },
    "nvd_repo_path": "2026/CVE-2026-4738.json",
    "references": [
      "https://github.com/OSGeo/gdal/pull/12244"
    ],
    "title": null,
    "updated": "2026-06-17T10:57:09.030000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-119"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-03-24T03:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-119"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://github.com/OSGeo/gdal/pull/12244"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV4_0": {
                  "score": 9.4,
                  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:P/AU:Y/R:U/V:C/RE:L/U:Amber"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "2cefe507-21fd-45cd-9e3a-a6f6a47b4278"
      },
      {
        "created": "2026-03-24T10:45:00+00:00",
        "data": [
          {
            "details": [
              "osgeo",
              "osgeo$PRODUCT$gdal"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "osgeo",
                "osgeo$PRODUCT$gdal"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "23143df8-1cc6-4f62-a658-909097fb990b"
      },
      {
        "created": "2026-03-24T15:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "04f2fa3f-3d33-40f2-82f0-5922a9cddfd4"
      }
    ],
    "cpes": {
      "data": [],
      "providers": []
    },
    "created": {
      "data": "2026-03-24T03:18:10.245000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {},
        "provider": null
      },
      "cvssV4_0": {
        "data": {
          "score": 9.4,
          "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:P/AU:Y/R:U/V:C/RE:L/U:Amber"
        },
        "provider": "mitre"
      },
      "epss": {
        "data": {
          "score": 0.00428
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://github.com/OSGeo/gdal/pull/12244"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-03-25T20:40:19.849829+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "osgeo",
        "osgeo$PRODUCT$gdal"
      ],
      "providers": [
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-119"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-03-24T03:18:10.245000+00:00",
    "description": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution",
    "updated": "2026-03-24T14:35:20.937000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/4xxx/CVE-2026-4738.json",
    "weaknesses": []
  }
}