CVE-2026-86095 in NetCDF-C
Summary
by MITRE • 09/05/2026
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified in Unidata netcdf-c versions through 4.10.1 represents a critical out-of-bounds write condition located within the NC4_HDF5_inq_attname function. This component is responsible for retrieving metadata attributes from HDF5 files, a common data format used extensively in scientific computing and climate modeling applications. The core technical flaw stems from an improper boundary check during string copying operations. Specifically, when enumerating attribute names, the software allocates or utilizes a fixed-size buffer of 256 bytes to store the retrieved name strings. However, the implementation fails to validate the length of the incoming HDF5 attribute name against this allocated limit before performing the copy operation. This lack of input validation allows an attacker who controls the content of an HDF5 file to supply an attribute name that exceeds the twenty-five-six byte threshold.
From a technical perspective, this flaw is classified under CWE-787 as an out-of-bounds write vulnerability. When the application processes a crafted file containing an oversized attribute name, the memory copy operation proceeds without truncation or bounds checking. Consequently, data beyond the end of the fixed buffer is written into adjacent regions of the heap or stack memory. This action corrupts critical memory structures such as metadata pointers, allocation headers, or return addresses depending on the specific context within the call stack. The immediate operational impact includes application crashes and denial-of-service conditions when programs attempt to enumerate attributes from maliciously crafted files. In more severe scenarios involving complex exploitation techniques, this memory corruption can potentially be leveraged to achieve arbitrary code execution by overwriting function pointers or control flow data structures with attacker-controlled payloads.
The security implications extend beyond simple stability issues because netcdf-c is often integrated into high-performance computing environments and automated scientific pipelines where untrusted data ingestion may occur. An adversary could distribute malicious HDF5 files through shared repositories, email attachments, or compromised datasets to trigger this vulnerability in vulnerable applications that parse these inputs. The attack vector aligns with ATT&CK technique T1203, which covers exploitation for client-side execution, particularly if the affected application is used by end-users who open documents without rigorous validation of file contents. Furthermore, since HDF5 files can be nested or processed recursively within larger workflows, this vulnerability may facilitate broader system compromise in environments where data integrity checks are not strictly enforced at ingestion points.
Mitigation strategies primarily involve upgrading to patched versions of netcdf-c released after version 4.10.1, which include fixes for the boundary validation logic in the affected function. For organizations unable to immediately patch their systems, defensive measures should focus on implementing strict input sanitization and length checks before passing attribute names to library functions that rely on fixed-size buffers. Additionally, enabling compiler-based security features such as stack canaries or Address Sanitizer during development phases can help detect similar issues early in the software lifecycle. Security teams should also audit their data ingestion pipelines to ensure that external HDF5 files are validated against expected schema constraints and size limits before being processed by vulnerable components. Regular vulnerability scanning of dependencies is recommended to maintain visibility over such library-level risks within larger application architectures.