CVE-2026-86095: Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unidata netcdf-cto a version that resolves this vulnerability.Fixed in 4.10.1 - Compensating control
Prevent untrusted HDF5/netCDF inputs from being processed by limiting which files users/applications can load (e.g., restrict inbound file sources) to reduce exposure to oversized HDF5 attribute names.
Event History
Frequently Asked Questions
What must an attacker do to trigger the vulnerability?
An attacker must provide a crafted HDF5 file containing an oversized attribute name and induce an application using the affected code to enumerate attribute names. Exploitation requires user interaction, as reflected by the UI:R vector.
Which systems are most exposed?
Applications that use Unidata netcdf-c to process untrusted or externally supplied HDF5 files are exposed when they enumerate HDF5 attribute names. The affected code is present in netcdf-c through version 4.10.1.
What is the likely impact if the flaw is triggered?
The oversized attribute name can overflow a fixed 256-byte destination buffer in NC4_HDF5_inq_attname(), causing memory corruption and application crashes. The supplied severity vector rates confidentiality, integrity, and availability impact as high.
How can teams reduce risk before a fix is available?
Avoid processing untrusted HDF5 files with affected applications, or isolate that processing in a restricted environment. Reject or sanitize files with attribute names exceeding 256 bytes before they reach affected netcdf-c code.