CVE-2026-86095

Unidata netcdf-c through version 4.10.1 contains an out-of-bounds write (CWE-787) in NC4_HDF5_inq_attname(), which copies HDF5 attribute names into a fixed 256-byte buffer without validating the name length. An attacker triggers the flaw by getting a vulnerable application to enumerate the attribute names of a crafted NetCDF-4/HDF5 file whose attribute name exceeds 256 bytes, for example by opening an untrusted data file in scientific analysis or data-pipeline software. The oversized copy corrupts adjacent memory, causing application crashes and potentially broader memory corruption; the CVSS 4.0 score of 8.5 (high) with high system impact reflects that potential, although the vector is local (AV:L) and requires the victim application to process the malicious file. Anyone running applications, libraries, or workflows that link netcdf-c at or below 4.10.1 and ingest NetCDF-4/HDF5 files from external sources is potentially affected. No public proof-of-concept, no CISA KEV listing, and a low EPSS (0.1% in 30 days, 3rd percentile) indicate exploitation is not currently observed, and no fixed version is identified in the available data.

What to do: Treat any netcdf-c deployment at or below 4.10.1 as vulnerable and upgrade to the first patched release once Unidata publishes one (no fixed version is stated in the available data). Until then, avoid opening NetCDF-4/HDF5 files of untrusted origin in applications linked against netcdf-c, and inventory which applications, language bindings, and HPC module stacks bundle the library. Prioritize environments that automatically ingest externally supplied scientific data files, such as data pipelines and shared archives.