The vulnerability is a heap buffer over‑read in the GDALRaster constructor when instantiated with a raw bytes object. The over‑read can expose adjacent memory contents, potentially leaking sensitive data, and accessing the vsi_buffer property may cause a segmentation fault, leading to service degradation. This flaw is classified as CWE‑126 and CWE‑805, threatening confidentiality and reliability of the affected application.

The issue affects Django releases 6.0 before 6.0.7 and 5.2 before 5.2.16; earlier series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be impacted by the same flaw.

The CVSS score of 6.3 indicates medium severity, while the EPSS score of less than 1 % suggests a very low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an external GIS byte payload supplied via a remote request to the application; an attacker would need to craft a malicious buffer that triggers the over‑read or segmentation fault, indicating that exploitation is possible if the application processes unvalidated GIS data.