CVE-2026-4738

GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution

Summary

Original description

The description as published by the source.

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.

This issue affects gdal: before 3.11.0.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami gdal

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-4738 gdal
Ubuntu UBUNTU-CVE-2026-4738 gdal

References

web github.com
web nvd.nist.gov