Out-of-bounds read in Django - CVE-2026-53877

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU137029

Out-of-bounds read in Django - CVE-2026-53877

Published: July 7, 2026


Vulnerability identifier: #VU137029
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53877
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow in django.contrib.gis.gdal.GDALRaster vsi_buffer handling when parsing a bytes object representing a raster file. A local user can supply a crafted raster bytes object to disclose sensitive information.

Only rasters stored in GDAL's virtual filesystem are affected, and the issue may also cause a segmentation fault in rare cases.


Affected software

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
python3-Django
python-django-help
python-django
python311-Django
python-django5

How to mitigate CVE-2026-53877

Install security update from vendor's website.

Django - addressed in versions 5.2.16, 6.0.7
python3-Django - addressed in versions 2.2.27-23, 4.2.15-17
python-django-help - addressed in versions 2.2.27-23, 4.2.15-17
python-django - addressed in versions 2.2.27-23, 4.2.15-17
python311-Django - update to 4.2.11-150600.3.62.1
python-django5 - addressed in versions 5.2.16-1.fc43, 5.2.16-1.fc44

External References

Related Security Bulletins