The vulnerability originates from the netCDF driver’s scanForGeometryContainers function, which copies a geometry attribute into a fixed-size stack buffer without validating the size, enabling a stack-based buffer overflow. This weakness (CWE-121) permits an attacker to inject code by crafting an oversized geometry attribute, resulting in arbitrary code execution on the system running GDAL.

GDAL 3.1.0 through 3.13.0, inclusive, are affected. These versions are susceptible to the overflow described above and are issued by the GDAL project.

With a CVSS score of 7.4 the vulnerability is high severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation yet retaining a significant risk if an attacker can supply a malicious NetCDF file to the target. The attack vector, inferred from the description, is that any process using GDAL to read NetCDF data could be hijacked by an attacker who can supply such a file.