A heap-based buffer overflow exists in the SWnentries function of OSGeo GDAL’s HDF-EOS module. The vulnerability is triggered by manipulating the DimensionName argument, allowing a locally running attacker to corrupt memory. If successful, this could result in a denial of service by crashing a GDAL process or other memory corruption effects. The weakness aligns with CWE-119 and CWE-122, indicating unsafe handling of buffer sizes and improper bounds checking.

The flaw is present in OSGeo GDAL versions up to 3.13.0dev-4. It is fixed in release candidate 3.12.4RC1 via patch commit 9491e794f1757f08063e... No other vendors are affected.

The CVSS score of 4.8 classifies the vulnerability as moderate. EPSS data is not available, but the exploit is publicly available and was demonstrated via the active PoC referenced in GitHub. The attack vector is local, meaning the attacker must have the ability to run code on the host or use a local GDAL process. Because it is not listed in CISA’s KEV catalog, it is not known to be actively exploited in the wild, yet the presence of a public PoC warrants immediate remediation.