Medium [CVE-2026-53877] Information disclosure via heap buffer over-read in GDALRaster

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Instantiating django.contrib.gis.gdal.GDALRaster with a bytes object representing a raster file can trigger a heap buffer over-read in the vsi_buffer property, reading roughly 32 bytes past the end of the allocated buffer.

An attacker who can supply crafted raster data may cause disclosure of adjacent heap memory or, in rare cases, crash the application process. This vulnerability in Django is rated as Low impact.

Exploitation is difficult due to the limited over-read size and specific input requirements, potentially leading to minor information disclosure or, rarely, a denial of service in Red Hat products that process untrusted geospatial raster data. Red Hat severity: Low — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

Weakness: CWE-126.