CVE-2026-4738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4738", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "state": "PUBLISHED", "assignerShortName": "GovTech CSG", "dateReserved": "2026-03-24T03:17:53.186Z", "datePublished": "2026-03-24T03:18:10.245Z", "dateUpdated": "2026-03-24T14:35:23.904Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-03-24T03:18:10.245Z"}, "title": "GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "type": "CWE"}]}], "affected": [{"vendor": "OSGeo", "product": "gdal", "collectionURL": "https://github.com/OSGeo/gdal", "modules": ["frmts/zlib/contrib/infback9"], "programFiles": ["inftree9.c\u200e"], "versions": [{"status": "affected", "version": "0", "lessThan": "3.11.0", "versionType": "git"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C\u200e.\n\nThis issue affects gdal: before 3.11.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules).<p> This vulnerability is associated with program files inftree9.C\u200e.</p><p>This issue affects gdal: before 3.11.0.</p>"}]}], "references": [{"url": "https://github.com/OSGeo/gdal/pull/12244", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "ATTACKED", "Safety": "PRESENT", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:P/AU:Y/R:U/V:C/RE:L/U:Amber"}}], "credits": [{"lang": "en", "value": "TITAN Team (titancaproject@gmail.com)", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:35:17.590340Z", "id": "CVE-2026-4738", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:35:23.904Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T14:35:17.590340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:35:20.937Z"}}], "cna": {"title": "GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "USER", "baseScore": 9.4, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:P/AU:Y/R:U/V:C/RE:L/U:Amber", "exploitMaturity": "ATTACKED", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OSGeo", "modules": ["frmts/zlib/contrib/infback9"], "product": "gdal", "versions": [{"status": "affected", "version": "0", "lessThan": "3.11.0", "versionType": "git"}], "programFiles": ["inftree9.c\u200e"], "collectionURL": "https://github.com/OSGeo/gdal", "defaultStatus": "affected"}], "references": [{"url": "https://github.com/OSGeo/gdal/pull/12244", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C\u200e.\n\nThis issue affects gdal: before 3.11.0.", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules).<p> This vulnerability is associated with program files inftree9.C\u200e.</p><p>This issue affects gdal: before 3.11.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-03-24T03:18:10.245Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4738", "state": "PUBLISHED", "dateUpdated": "2026-03-24T14:35:23.904Z", "dateReserved": "2026-03-24T03:17:53.186Z", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "datePublished": "2026-03-24T03:18:10.245Z", "assignerShortName": "GovTech CSG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/OSGeo/gdal", "defaultStatus": "affected", "modules": ["frmts/zlib/contrib/infback9"], "product": "gdal", "programFiles": ["inftree9.c\u200e"], "vendor": "OSGeo", "versions": [{"lessThan": "3.11.0", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve_disclosure@tech.gov.sg"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C\u200e.\n\nThis issue affects gdal: before 3.11.0."}, {"lang": "es", "value": "Vulnerabilidad de Restricci\u00f3n Incorrecta de Operaciones dentro de los L\u00edmites de un B\u00fafer de Memoria en OSGeo gdal (m\u00f3dulos frmts/zlib/contrib/infback9). Esta vulnerabilidad est\u00e1 asociada con los archivos de programa inftree9.C.\n\nEste problema afecta a gdal: anterior a 3.11.0."}], "id": "CVE-2026-4738", "lastModified": "2026-06-17T10:57:09.030", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "ATTACKED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4738", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:35:17.590340Z", "version": "2.0.3"}}]}, "published": "2026-03-24T04:17:29.000", "references": [{"source": "cve_disclosure@tech.gov.sg", "url": "https://github.com/OSGeo/gdal/pull/12244"}], "sourceIdentifier": "cve_disclosure@tech.gov.sg", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.11.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gdal", "source": "cna", "vendor": "OSGeo"}, "product": "gdal", "vendor": "osgeo"}], "analysis": {"en": {"generated_at": "2026-03-24T04:21:08.503723+00:00", "value": {"mitigation_remediation": ["Upgrade GDAL to version 3.11.0 or newer.", "If an immediate upgrade is not possible, limit GDAL processing to trusted inputs and monitor for unusual activity.", "Verify the GDAL version on all systems and apply any available vendor patches."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "OSGeo GDAL releases prior to version 3.11.0 are affected by this flaw. The vulnerability impacts the zlib decompression component within GDAL, especially the inftree9.c module. Administrators should check all installations running GDAL below 3.11.0 to determine exposure.", "description_and_impact": "The vulnerability arises from an improper restriction of operations within the bounds of a memory buffer in OSGeo GDAL, specifically within the frmts/zlib/contrib/infback9 modules. The flaw originates in the inftree9.c file, where a pointer offset optimization leads to undefined behavior. An attacker can trigger this error to corrupt heap memory, potentially escalating to remote code execution. This weakness aligns with CWE\u2011119, which involves buffer overflow or underflow attacks.", "risk_and_exploitability": "The CVSS score of 9.4 indicates critical severity, though direct exploit evidence is not documented in the current advisory. The vulnerability is not yet listed in CISA\u2019s KEV catalog, and no EPSS value is available. Likely exploitation would involve feeding a crafted zlib stream to GDAL\u2019s decompression routine, causing the undefined behavior and enabling remote code execution. Because the flaw resides in a widely used geospatial library, the potential impact spans any system that processes untrusted geospatial data."}}}}, "created": "2026-03-24T10:29:14.616530+00:00", "updated": "2026-03-25T20:40:19.849829+00:00", "vendors": ["osgeo", "osgeo$PRODUCT$gdal"]}