# gdal (PyPI) vulnerabilities

11 known vulnerabilities (1 high, 7 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 77.4K
- Dependents: 467
- Registry: https://pypi.org/project/gdal/

## Advisories (11)

### [CVE-2026-49014](https://cve.now/CVE-2026-49014): In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow.

- Severity: High 7.4
- Published: May 27, 2026
- Affected: from 3.1.0, fixed in 3.13.1.

### [CVE-2026-8213](https://cve.now/CVE-2026-8213): OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow

- Severity: Medium 4.8
- Published: May 9, 2026
- Affected: fixed in 3.13.0.

### [CVE-2026-8212](https://cve.now/CVE-2026-8212): OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow

- Severity: Medium 4.8
- Published: May 9, 2026
- Affected: fixed in 3.13.0RC1; version range not reported.

### [CVE-2026-8088](https://cve.now/CVE-2026-8088): OSGeo gdal GDapi.c GDfieldinfo out-of-bounds

- Severity: Medium 4.8
- Published: May 7, 2026
- Affected: fixed in 3.13.0.

### [CVE-2026-8087](https://cve.now/CVE-2026-8087): OSGeo gdal GDapi.c GDnentries heap-based overflow

- Severity: Medium 4.8
- Published: May 7, 2026
- Affected: fixed in 3.13.0.

### [CVE-2026-8086](https://cve.now/CVE-2026-8086): OSGeo gdal SWapi.c SWnentries heap-based overflow

- Severity: Medium 4.8
- Published: May 7, 2026
- Affected: fixed in 3.13.0.

### [CVE-2026-8084](https://cve.now/CVE-2026-8084): OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds

- Severity: Medium 4.8
- Published: May 7, 2026
- Affected: fixed in 3.13.0.

### [CVE-2025-29480](https://cve.now/CVE-2025-29480): Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release…

- Severity: Medium 5.5
- Published: Apr 7, 2025
- Affected: through 3.10.2-NA.

### [CVE-2021-45943](https://cve.now/CVE-2021-45943): GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from…

- Severity: Unrated
- Published: Dec 31, 2021
- Affected: from 3.3.0, fixed in 3.4.1.

### [CVE-2019-25050](https://cve.now/CVE-2019-25050): netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4\_get\_att (called from nc4\_get\_att\_tc and nc\_get\_att\_text) and…

- Severity: Unrated
- Published: Jul 20, 2021
- Affected: from 2.4.2, fixed in 3.1.0.

### [CVE-2019-17545](https://cve.now/CVE-2019-17545): GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr\_expat.cpp when the 10MB threshold is exceeded.

- Severity: Unrated
- Published: Oct 14, 2019
- Affected: fixed in 3.0.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/gdal
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.