A buffer overflow condition resides in the GDfieldinfo function of the GDapi.c file within OSGeo GDAL, affecting all releases up to 3.13.0dev-4. The flaw permits an out-of-bounds read of memory, exposing data that resides beyond the intended buffer boundaries. The vulnerability is an example of the classic input validation error (CWE‑119) and an unchecked array access (CWE‑125). If triggered, the result may be the disclosure of sensitive information or the destabilisation of the process that runs GDAL.

All installations of OSGeo GDAL with a version equal to or less than 3.13.0dev-4 are vulnerable. The fix is included in release 3.13.0RC1, so updating to that version or any newer release will eliminate the flaw.

The CVSS score of 4.8 places the vulnerability in the medium severity range. No EPSS data is supplied and the vulnerability is not listed in the CISA KEV catalog, suggesting there are no widespread public exploits yet. Nonetheless, the exploit requires local execution, which makes it pertinent for environments that run GDAL on untrusted input or from users with local access rights. The publicly available proof‑of‑concept indicates that an attacker who can execute code on the host can trigger the read, potentially exposing or corrupting data handled by GDAL.