A flaw in OSGeo GDAL causes a heap-based buffer overflow when the GDnentries function in GDapi.c processes a malformed DataFieldName argument. The overflow breaches heap memory boundaries, and it notes that the attack must originate locally. A public exploit is available, indicating that the vulnerability can be leveraged by an adversary who controls data processed by GDAL.

The issue exists in all OSGeo GDAL releases up to and including 3.13.0dev-4. Users are advised to upgrade to version 3.13.0RC1 or newer, which incorporates the patch identified by commit 184f77dbcc74118c062c05e464c88161d3c37b9b. No other vendors or products are currently reported as affected.

The CVSS score of 4.8 places the flaw in the moderate severity range, while the EPSS score is not available, suggesting limited publicly observed exploitation data. The vulnerability is not listed in the CISA KEV catalog, yet the existence of a released exploit means that any system running GDAL and processing untrusted data is at risk. Because the attack vector is local, protecting GDAL execution to trusted users and environments reduces exposure, but the presence of a local exploit makes remediation a priority.