CVE-2026-86095

Description

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

References

• https://github.com/Unidata/netcdf-c
• https://github.com/Unidata/netcdf-c/blob/v4.10.1/libhdf5/hdf5attr.c
• https://www.vulncheck.com/advisories/unidata-netcdf-c-through-4.10.1-out-of-bounds-write-via-oversized-hdf5-attribute-name