HIGH 8.5 NVD
CVE-2026-86095
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte b
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
References
- https://github.com/Unidata/netcdf-c
- https://github.com/Unidata/netcdf-c/blob/v4.10.1/libhdf5/hdf5attr.c
- https://www.vulncheck.com/advisories/unidata-netcdf-c-through-4.10.1-out-of-bounds-write-v
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-09-04 via NVD.
vulnfeed aggregates 10149 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.