Loading vulnerability…
Out-of-bounds pointer arithmetic in OSGeo GDAL and zlib infback9
CVE-2026-4738 is a memory-buffer bounds vulnerability in the infback9 component bundled with OSGeo GDAL versions before 3.11.0 and distributed with zlib. The affected code performs out-of-bounds pointer arithmetic, although the pointers return within bounds before use. No compiler is known to mishandle this arithmetic, but capability-based hardware such as CHERI could trap on it. The fix removes the out-of-bounds pointer arithmetic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A possible impact is process termination or service disruption if capability-based hardware such as CHERI traps on the out-of-bounds pointer arithmetic. Practical exploitation on conventional platforms is not established: the pointers return within bounds before use, and no compiler mishandling or known exploit has been identified. Published high confidentiality and integrity impact ratings are not substantiated by the available technical details.
If you can’t patch tonight, do this now.
Pending an upgrade, avoid processing untrusted compressed input through the affected infback9 component where feasible. No specific configuration workaround is established.
Patch, then assume compromise.
Upgrade OSGeo GDAL to version 3.11.0 or later. For affected standalone zlib installations, upgrade to zlib 1.4 or apply the corresponding vendor patch removing the out-of-bounds pointer arithmetic in infback9. On Alpine Linux, update affected zlib and related packages to version 1.4-r0 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.