The vulnerability arises from an improper restriction of operations within the bounds of a memory buffer in OSGeo GDAL, specifically within the frmts/zlib/contrib/infback9 modules. The flaw originates in the inftree9.c file, where a pointer offset optimization leads to undefined behavior. An attacker can trigger this error to corrupt heap memory, potentially escalating to remote code execution. This weakness aligns with CWE‑119, which involves buffer overflow or underflow attacks.

OSGeo GDAL releases prior to version 3.11.0 are affected by this flaw. The vulnerability impacts the zlib decompression component within GDAL, especially the inftree9.c module. Administrators should check all installations running GDAL below 3.11.0 to determine exposure.

The CVSS score of 9.4 indicates critical severity, though direct exploit evidence is not documented in the current advisory. The vulnerability is not yet listed in CISA’s KEV catalog, and no EPSS value is available. Likely exploitation would involve feeding a crafted zlib stream to GDAL’s decompression routine, causing the undefined behavior and enabling remote code execution. Because the flaw resides in a widely used geospatial library, the potential impact spans any system that processes untrusted geospatial data.