CVE-2025-14935
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Heap-based buffer overflow in NetCDF-C library when parsing dimension names. Lack of validation of user-supplied data length before copying to a fixed-length heap buffer allows remote code execution.
Risk Assessment
An attacker can execute arbitrary code in the context of the current user if the victim opens a malicious file or page. User interaction is required, but it can lead to full system compromise.
Recommendation
Update NetCDF-C library to the latest patched version. Avoid opening untrusted NetCDF files.
Other vulnerabilities in NetCDF-C
See all- CVE-2026-86095High
Unidata netcdf-c through 4.10.1 has an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Crafted HDF5 files with oversized attribute names can overflow the buffer, causing memory corruption and crashes.
- CVE-2025-14936High
Stack-based buffer overflow in NetCDF-C library when parsing attribute names. Lack of validation of user-supplied data length before copying to a fixed-length stack buffer allows remote code execution.
- CVE-2025-14934High
Stack-based buffer overflow in NetCDF-C library when parsing variable names. Lack of validation of user-supplied data length before copying to a fixed-length stack buffer allows remote code execution.
- CVE-2025-14932High
Stack-based buffer overflow in NetCDF-C library when parsing time units. Lack of validation of user-supplied data length before copying to a fixed-length stack buffer allows remote code execution.
Original NVD description (English source)
NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of dimension names. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27168.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS