Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
Hello, Thank you for maintaining GDAL in Fedora. I've attached a backport of the upstream fix for CVE-2026-49014 for Fedora 43 and 44, and would appreciate your review. CVE-2026-49014 is a stack buffer overflow in the netCDF driver. When GDAL opens a netCDF file that declares CF-1.8 or later conventions, scanForGeometryContainers() (frmts/netcdf/netcdfsg.cpp) copies each variable's "geometry" attribute into a fixed 255-byte stack buffer without checking the attribute's length. A crafted file with a longer attribute overflows the buffer, which the CVE describes as leading to arbitrary code execution in the process running GDAL. Fedora 43 (3.11.5) and Fedora 44 (3.12.4) are affected. Fedora 45 and Rawhide (3.13.3) already include the fix, which first shipped upstream in 3.13.1. The attachment is upstream commit c49254dc6380af2f02ff43ca79e3cf7c1bc82f01 (OSGeo/gdal#14594), unmodified. It adds an NCDFGetAttr() overload that checks the attribute type and length and reads into a std::string of the right size. It then switches the fixed-buffer text-attribute reads in netcdfsg.cpp and netcdfdataset.cpp over to it, replacing the old attrf() helper. Testing: the patch applies cleanly to the current Fedora 43 and 44 sources (those three files are identical to upstream 3.11.5 and 3.12.4). I confirmed that the patched Fedora 44 source no longer has the fixed-buffer read. I did not have a crafted netCDF file to reproduce the overflow at runtime. AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Thank you for taking a look.
Created attachment 2161890 [details] upstream patch