A buffer handling issue in the HDF‑EOS Grid File Handler of OSGeo GDAL causes an out‑of‑bounds read when processing HDF‑EOS Grid files. This flaw can expose memory contents and potentially reveal sensitive information. The weakness is classified as CWE‑119 and CWE‑125.

The vulnerability affects all installed copies of OSGeo GDAL up to version 3.13.0dev‑4. The documented fix is included in release 3.13.0RC1 and later, so systems running any earlier version should be updated.

The CVSS score of 4.8 indicates moderate severity. Because the exploit is limited to local execution and the EPSS score is not available, the likelihood of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Even so, any local attacker that can place malicious HDF‑EOS Grid files on the system could exploit the out‑of‑bounds read and potentially gain access to privileged data. Upgrading the vulnerable component or otherwise removing the affected code path mitigates the risk.