CVE-2019-17545: Debian Linux

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 30 only; version 31 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• Oracle Spatial And Graph: version 12.2.0.1 only; version 19c only
• OSGeo Gdal: up to and including 3.0.1

Published 2019-10-14. Last modified 2026-06-17.