CVE-2026-86095

HIGH 7.8

Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

CWE	CWE-787
Vendor	unidata
Product	netcdf-c
Published	Sep 4, 2026
Last Updated	Sep 8, 2026

Stay Ahead of the Next One

Get instant alerts for unidata netcdf-c

Be the first to know when new high vulnerabilities affecting unidata netcdf-c are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Unidata / netcdf-c

0 ≤ 4.10.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Unidata/netcdf-c github.com: https://github.com/Unidata/netcdf-c/blob/v4.10.1/libhdf5/hdf5attr.c vulncheck.com: https://www.vulncheck.com/advisories/unidata-netcdf-c-through-4.10.1-out-of-bounds-write-via-oversized-hdf5-attribute-name

Credits

Michael Holmquist