CVE-2026-8213 — OSGeo Gdal Buffer Overflow

title: Local Heap Overflow Exploitation via OSGeo Gdal GDapi.c - CVE-2026-8213
id: scw-2026-05-09-ai-1
status: experimental
level: high
description: |
  This rule detects the execution of OSGeo Gdal utilities (gdalinfo, ogrinfo, gdal) with specific command-line arguments that are often used in conjunction with exploiting the heap-based buffer overflow vulnerability in GDapi.c (CVE-2026-8213). The vulnerability is triggered locally and affects versions up to 3.13.0dev-4. The exploit involves manipulating the Grid File Handler component. This detection focuses on the potential local exploitation vector.
author: SCW Feed Engine (AI-generated)
date: 2026-05-09
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8213/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\OSGeo4W\bin\gdalinfo.exe'
          - 'C:\Program Files\OSGeo4W\bin\ogrinfo.exe'
          - 'C:\Program Files\OSGeo4W\bin\gdal.exe'
      CommandLine|contains:
          - '-stats'
          - '-q'
      ParentImage|contains:
          - 'cmd.exe'
          - 'powershell.exe'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse