CVE-2026-86095
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Unidata netcdf-c through 4.10.1 has an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Crafted HDF5 files with oversized attribute names can overflow the buffer, causing memory corruption and crashes.
Risk Assessment
The vulnerability can cause crashes in applications processing HDF5 files, potentially enabling denial-of-service attacks. In worst cases, it might allow arbitrary code execution, posing a serious risk to systems using netcdf-c.
Recommendation
Upgrade netcdf-c to a version newer than 4.10.1 that includes a fix for the buffer overflow.
Other vulnerabilities in netcdf-c
See all- CVE-2025-14936High
Stack-based buffer overflow in NetCDF-C library when parsing attribute names. Lack of validation of user-supplied data length before copying to a fixed-length stack buffer allows remote code execution.
- CVE-2025-14935High
Heap-based buffer overflow in NetCDF-C library when parsing dimension names. Lack of validation of user-supplied data length before copying to a fixed-length heap buffer allows remote code execution.
- CVE-2025-14934High
Stack-based buffer overflow in NetCDF-C library when parsing variable names. Lack of validation of user-supplied data length before copying to a fixed-length stack buffer allows remote code execution.
- CVE-2025-14932High
Stack-based buffer overflow in NetCDF-C library when parsing time units. Lack of validation of user-supplied data length before copying to a fixed-length stack buffer allows remote code execution.
Original NVD description (English source)
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS