ANT-2026-4PKJCSR8 · osgeo/gdal

heap-buffer-overflow high

Severity Claude critical · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-4PKJCSR8: Heap-buffer-overflow in gdal

In GDAL's bundled g2clib, specunpack() allocates the ifld buffer as ndptssizeof(g2int) and then calls gbits() to unpack Ts elements into it, where Ts is idrstmpl[8] taken directly from the GRIB2 Data Representation Section without validation. A crafted GRIB2 file using DRS template 5.51 can set Ts > ndpts, causing the store at gbits.c:74 ((iout+i) = itmp;) to write past the allocated region. ASAN confirms a WRITE of size 4 immediately past a 16-byte heap allocation. The attacker controls Ts (and thus the overflow extent) via file contents, yielding heap memory corruption and at minimum a crash when GDAL opens the file.

Target

Project: osgeo/gdal

Technical Details

ASAN: heap-buffer-overflow WRITE of size 4 at 0x502000012a20 in gdal_gbits (gbits.c:74). Root cause: in specunpack() (reached via g2_unpack7 when idrsnum == 51), ifld is malloc'd for ndpts g2int elements, but the first gbits() call unpacks Ts = idrstmpl[8] elements into ifld. Ts is read from the GRIB2 file with no check that Ts <= ndpts, so a malformed file overflows ifld on the heap.

Crash trace:

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3580123152
INFO: Loaded 1 modules   (1021857 inline 8-bit counters): 1021857 [0x5ce901bd7460, 0x5ce901cd0c01), 
INFO: Loaded 1 PC tables (1021857 PCs): 1021857 [0x5ce901cd0c08,0x5ce902c68618), 
/out/gdal_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-4PKJCSR8.

Reference: ANT-2026-4PKJCSR8
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict: true positive
Severity: high

UPSTREAM FIX

The change that resolved this finding.

diff --git a/frmts/grib/degrib/g2clib/specunpack.c b/frmts/grib/degrib/g2clib/specunpack.c
index da976d1e549d..eb09f1af6cc2 100644
--- a/frmts/grib/degrib/g2clib/specunpack.c
+++ b/frmts/grib/degrib/g2clib/specunpack.c
@@ -67,6 +67,13 @@ g2int specunpack(unsigned char *cpack,g2int *idrstmpl,g2int ndpts,g2int JJ,
 
       if (idrstmpl[9] == 1) {           // unpacked floats are 32-bit IEEE
 
+         if (Ts > ndpts)
+         {
+             fprintf(stderr, "specunpack: invalid Ts=%d vs ndpts=%d.\n", Ts, ndpts);
+             for (j=0;j<ndpts;j++) fld[j]=0.0;
+             return -1;
+         }
+
          unpk=(g2float *)malloc(ndpts*sizeof(g2float));
          ifld=(g2int *)malloc(ndpts*sizeof(g2int));

https://github.com/OSGeo/gdal/commit/75cbc453e7491ec10442ee1c9d37a03aef237a00

TIMELINE

Recorded dates, in order.

2026-03-24 Discovered or logged
2026-04-29 Sent to maintainer
2026-05-08 Patch released
2026-05-12 Maintainer acknowledged
2026-07-08 Publicly revealed

PROVENANCE

SHA-3-512 hash:

97ac254e71a7a9d8ccc76c07181dc668616c36c0ee2c1a31b812a1c57ec382e579db8c3b870617860b644351b8062a803d4caaf9c1c43400c6633c17122d731a

Committed 2026-05-07 21:16 UTC

Revealed 2026-07-08 23:01 UTC

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-4PKJCSR8",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:31:35+00:00",
  "description": "In GDAL's bundled g2clib, specunpack() allocates the ifld buffer as ndpts*sizeof(g2int) and then calls gbits() to unpack Ts elements into it, where Ts is idrstmpl[8] taken directly from the GRIB2 Data Representation Section without validation. A crafted GRIB2 file using DRS template 5.51 can set Ts > ndpts, causing the store at gbits.c:74 (*(iout+i) = itmp;) to write past the allocated region. ASAN confirms a WRITE of size 4 immediately past a 16-byte heap allocation. The attacker controls Ts (and thus the overflow extent) via file contents, yielding heap memory corruption and at minimum a crash when GDAL opens the file.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "gdal",
  "reproduction": null,
  "technical_details": "ASAN: heap-buffer-overflow WRITE of size 4 at 0x502000012a20 in gdal_gbits (gbits.c:74). Root cause: in specunpack() (reached via g2_unpack7 when idrsnum == 51), ifld is malloc'd for ndpts g2int elements, but the first gbits() call unpacks Ts = idrstmpl[8] elements into ifld. Ts is read from the GRIB2 file with no check that Ts <= ndpts, so a malformed file overflows ifld on the heap.",
  "title": "Heap-buffer-overflow in gdal",
  "vendor_severity": "high"
}